Extracted

• • Target

    2025-02-01_3e00badf3dad2fe1c427f9dcbd3af132_mafia

  • Size

    10.9MB

  • MD5

    3e00badf3dad2fe1c427f9dcbd3af132

  • SHA1

    2c24740612b6898181e04cd18417c3e5a826a416

  • SHA256

    5500b8a4b2bc75d90f9a81116726d643dbd0822b2dbcab9fc18dd584abdccaa7

  • SHA512

    5147431e831baf236db10c2a3d6e3d299444a76af2f74d1da17a5837be509931bb487fd6a240b30b02bf971efbdd9c1c0e9dc2a0279c335c85309132c87773c4

  • SSDEEP

    24576:x6WdLQkyQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQI:YWdLQk

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2