Extracted

• • Target

    2025-02-02_35496f3210be76bdf152e68c2d006c97_mafia

  • Size

    14.7MB

  • MD5

    35496f3210be76bdf152e68c2d006c97

  • SHA1

    71edf2a785a3d8c2c202115c56a915c0055b82c6

  • SHA256

    a740950cb54ce7abb6840c2053dcd15c60a414976ba39184e52447622e634d77

  • SHA512

    7abd43f7c0de5ce5b6ef72d8e5c9d3e72698aadc48049dfafd72a449fcec149580e241da52b94ae341e21b7de8855801431d3079d26a14696a24cbf9d9d13b8e

  • SSDEEP

    24576:UpomTTN9ttttttttttttttttttttttttttttttttttttttttttttttttttttttt3:goo

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2