Extracted

• • Target

    2025-02-01_b0af9ab857da603db7f5ca223f96ec20_mafia

  • Size

    12.2MB

  • MD5

    b0af9ab857da603db7f5ca223f96ec20

  • SHA1

    4d8ddfddc599382819c03d96fc1050adbb76b56f

  • SHA256

    34fa1ec69a9bf956160c9ebcd19f5fa1cb856f92a4f06148682d150a8a2a4417

  • SHA512

    20c7598e64398fb8da3303079ede0edd792a962af8da52de5685c48656e14124a07379f47c5b52b57f6d3993601d885ebbff71bfb012b57e7575f31f33efdab7

  • SSDEEP

    393216:IXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX3:

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2