Extracted

• • Target

    2025-02-01_c599f2a3400f4a202674d99dc7e018f2_mafia

  • Size

    11.6MB

  • MD5

    c599f2a3400f4a202674d99dc7e018f2

  • SHA1

    486fd0ff2f0b2f2ff8d9b0f881ee4dcef8a794db

  • SHA256

    30db7f3a80913f3a6103ec7422b5b27178f0968752e816b244c1754071b1cade

  • SHA512

    67c21d11173c57e2068f7d761439e6a957c8aae54e5007ff03c52602f0acad8552a698583b93ebd54f57a6cf8219257e7cff55a6fae48360c602cdd8aeada2f7

  • SSDEEP

    6144:ZLQ1p/2p5e+D2jFHO+iZoy6u9FlfrXEz9NQNQNQNQNQNQNQNQNQNQNQNQNQNQNQg:6TYe+D2jFu+iZoUFhAz

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2