Extracted

• • Target

    2025-02-02_d0609b127ab371e7e8c2a7a9c1c125d3_mafia

  • Size

    11.0MB

  • MD5

    d0609b127ab371e7e8c2a7a9c1c125d3

  • SHA1

    5e96aa8f0505ffc8252c6a5f0cf683785e941cba

  • SHA256

    0fd46860fa68b2e1ab04ce983213eb847d10cf1579bce69780e8059015d6ed50

  • SHA512

    ccb251f9592c738256d678085430ffd19c0bb55954f2a66d96f46229966911c96a41b5bde6e12c6b9018b8ca0bcc53650df6a66314f5e6cad684db4e366770af

  • SSDEEP

    3072:0LBgXOXcdW8tar7vGdq8c7YMl2b8anmMXnb58XuDP9het3Zv1oSW1za2E+w5C2/Y:xOMdRQr7OB0ypmMXnl8XEPM3noSWOC

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2