Extracted

• • Target

    2025-02-02_381381242335bd0bee0747b0b1f9b5ab_mafia

  • Size

    12.3MB

  • MD5

    381381242335bd0bee0747b0b1f9b5ab

  • SHA1

    6f5c445fda03ebe6c1d543e0e77e9dea6483d4b1

  • SHA256

    f6447aa548beb265ea43df6c97b9b55d10455908e8c3c6406375a99b84c14f32

  • SHA512

    30d485e0c4ce7edfa8c483bb48ecfed4fdfb7105be2bd190b971d45d40add05a4e6d520b5608334a9638f994261645cfbf532c8e086b7885dc713f6072a6b7ed

  • SSDEEP

    6144:CLQ1p/2p5e+D2jFHO+iZoy6u9FlfrXEz9NQNQNQNQNQNQNQNQNQNQNQNQNQNQNQt:jTYe+D2jFu+iZoUFhAz

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2