Extracted

• • Target

    2025-02-02_f41889aa43d1fcdf7f1f7547f53b2bd3_mafia

  • Size

    10.4MB

  • MD5

    f41889aa43d1fcdf7f1f7547f53b2bd3

  • SHA1

    1e13ed50aec8bb2bd2b129135ff85043fabe4f92

  • SHA256

    bb393cf9bbb120a19a336bd850f23d92d0cca7aa70556d8f27cbdd64f2cef23e

  • SHA512

    c53bbf159ce09f67b0802b2f0b175331dcbaa47005b859f7f409df65ff6b03c167446b781f7ba40e0b21cb4c45178c96580efd09f931d1807460a8e823f2dfc3

  • SSDEEP

    24576:96WdLQkyQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ:sWdLQk

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2