Extracted

• • Target

    2025-02-02_bc3aeacaad88d5f79b2d1b0c2dd6505b_mafia

  • Size

    11.6MB

  • MD5

    bc3aeacaad88d5f79b2d1b0c2dd6505b

  • SHA1

    28a2a6f0d86eced1517a71b3b347ca58f7f4aad5

  • SHA256

    c9ed14c522bd09ed20918fde47044532ee1cdf601deae9d6718f5fb928af8ddb

  • SHA512

    9fd50aeb505ef173c846951c989c8e77c1346b4b78e10b0eb5927122d7842188f7426ce755e1f06c9ea6a33b9cda4d103deaa5a57c95bfe629a2b96ac8048f86

  • SSDEEP

    3072:uLBgXOXcdW8tar7vGdq8c7YMl2b8anmMXnb58XuDP9het3Zv1oSW1za2E+w5C2/Y:3OMdRQr7OB0ypmMXnl8XEPM3noSWOC

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2