Extracted

• • Target

    2025-02-02_fab4de48010f51b4aa8aa0751b525553_mafia

  • Size

    12.2MB

  • MD5

    fab4de48010f51b4aa8aa0751b525553

  • SHA1

    8cb8355eea57313d0761160f89d8782cbd69b359

  • SHA256

    c112f21a28911d1995b8a33f5e8310764421a058e250d07e8a2d5c78e1e38b97

  • SHA512

    98afc6fa1aa0f8053cc68d9f2e291454c3f6a07fc0702b7c4934c812c089625558d47fb44e7f31e19ff68ab00f71a672e8444b2e8ab27cb5e3c4a744dd6bf6ab

  • SSDEEP

    24576:PEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZH:Mfot

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2