Extracted

• • Target

    2025-02-02_09c7d870826a2d9195bdf05d217b81c9_mafia

  • Size

    10.1MB

  • MD5

    09c7d870826a2d9195bdf05d217b81c9

  • SHA1

    e2caaa504993c218feceed300eb5304bc25de14e

  • SHA256

    ad3b1b5f8abd9b8186ee901709e414e879c25692e5b731185759eef23c8fa6f9

  • SHA512

    22bf9f6e7c92e2ba36d4c7f5999e41a55411644ccced3d99f8c057a3c15fba3a65cb94800bae99e95f49fede84ed88842fed9cb3dd2ca9e67cca5803b5b796df

  • SSDEEP

    24576:n6WdLQkyQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQZ:6WdLQkf

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2