Extracted

• • Target

    2025-02-02_f101a6bc90173ca5c88c5789b42012a9_mafia

  • Size

    10.9MB

  • MD5

    f101a6bc90173ca5c88c5789b42012a9

  • SHA1

    11121d98e1354a89b6be8fa20031d18a691f7282

  • SHA256

    73d3a15cbf2312b8b5e83c9d9dc0ef9a7ca79d7801cc853088c7daa28802b7aa

  • SHA512

    698a605cf139b2c8e34ab0fba2aa01de66db23b193ced740a6e04503609e40ff3e550373b2e6e18a9ec3c7ff6a054247909766c396464b08067083c41d9b84dd

  • SSDEEP

    49152:/qE0YKr3fYPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP3:/qtYc3i

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2