Extracted

• • Target

    2025-02-01_aa8d578acf6c92b0968b8c7dbf672948_mafia

  • Size

    13.3MB

  • MD5

    aa8d578acf6c92b0968b8c7dbf672948

  • SHA1

    0fa983431334849b7e4cef6ed327a8c128f25119

  • SHA256

    8bb9c66cc73b87c00009d7242459b2076fe1f3abade22c59acda2ec7d6b84f4e

  • SHA512

    30d04bd9e56ef823396d6b06d3b235b18f237da42b12585f36054eb3c62bfbc6f90bc411a1906a371410028b62d6b4711808edd32374ddff57fb6ead068ed8ae

  • SSDEEP

    24576:86WdLQkyQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ4:RWdLQk

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2