Extracted

• • Target

    2025-02-02_694b78eeab46dddf1b29828b11336439_mafia

  • Size

    12.3MB

  • MD5

    694b78eeab46dddf1b29828b11336439

  • SHA1

    2c93a58c3364a721884d0ac66d43a5bd14dc2762

  • SHA256

    01ca163479f86dfeb9d4257e4ffff6cf8bee69bad7f31557d0900276f7bd8589

  • SHA512

    66c7576791a3259c81ab9f29d0623e7b6d3c31d647680153bda0e825fb2e0dc88f12b3a1496674b9197cc743a3b0f6f5fbb65c554210546a09503a08fa623a26

  • SSDEEP

    24576:BEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+:afots

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2