Extracted

• • Target

    2025-02-02_ceaaf95f3018751179edd1ab5135602d_mafia

  • Size

    11.6MB

  • MD5

    ceaaf95f3018751179edd1ab5135602d

  • SHA1

    65a3f4a21eb43af3e706261b96b9dd26e266d405

  • SHA256

    b80c11b49dbc53292afd6a4749a61ed5f0ceeadd3f0b6c1f56516bac82a4a3c5

  • SHA512

    46515f511973f910405258fbc15a78ed9fc953737855dd00e44959b6a59500e42d381e376df5864ad985a80bdee75b4b721d3927cc7da6fc2388968d3cfea573

  • SSDEEP

    24576:aEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZr:zfot

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2