Extracted

• • Target

    2025-02-02_a35c957b4f8a7a0c3fe58cd1ac2f0672_mafia

  • Size

    12.2MB

  • MD5

    a35c957b4f8a7a0c3fe58cd1ac2f0672

  • SHA1

    5102b2d974b7899ae3af26a70347b1402f899f06

  • SHA256

    c7183eb47b826d082820e8718f7eb2b43811ad9793a06e79c2c685d1e3fe0be2

  • SHA512

    beda679f54642a680c84e1370a59b51055ac91c63f6d0c45f3df4fe48b7a30b626069043498732751101ae1435274d8bfb5e6595aacd468a15d405685f8e92b0

  • SSDEEP

    24576:h6WdLQkyQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQ:IWdLQk

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2