Extracted

• • Target

    2025-02-02_21aa80f7c0de8d455dd905294073ea40_mafia

  • Size

    10.7MB

  • MD5

    21aa80f7c0de8d455dd905294073ea40

  • SHA1

    a1e2df714121b93f0d36d492564276ec78e2b5fe

  • SHA256

    7ddae85a7f3628c9ac2fb4b57b97789395902111a902d5db117897420037dcbb

  • SHA512

    f0731e6f00cb55ce4ae9d5f6aa0605cf0d99e63fed1ee021bda4f22176d0645189eaba3406e4a2a92449ce7d50ecb0b769683f6fee557e4e5f2679de76ea7aa8

  • SSDEEP

    196608:jyXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXs:OXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX8

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2