Extracted

• • Target

    2025-02-02_48fc0a55d58597e8c80253d426a0aed5_mafia

  • Size

    10.1MB

  • MD5

    48fc0a55d58597e8c80253d426a0aed5

  • SHA1

    171c847a8721a589d93f808cd8ed765860c1e80b

  • SHA256

    320f07e8a963da09c856d379b523942997bfb14e86da7372f657c935a305f33a

  • SHA512

    9a4288344974ab75a516b8f9892ad65f97a91aa0af20adb57017245b5756e3208860dbc3ddd71f2a042bb92fdc54ae08314b36f11bcc8b674f3714324d00bb5d

  • SSDEEP

    3072:oLBgXOXcdW8tar7vGdq8c7YMl2b8anmMXnb58XuDP9het3Zv1oSW1za2E+w5C2/Y:lOMdRQr7OB0ypmMXnl8XEPM3noSWOC

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2