Extracted

• • Target

    2025-02-03_aea54ad2d5cbdd85e9515c75e4849edd_mafia

  • Size

    13.6MB

  • MD5

    aea54ad2d5cbdd85e9515c75e4849edd

  • SHA1

    6dbcaabb7b0db5779c88b64d53ab1d97cfc9e686

  • SHA256

    b74ea2c28c3157d6261d1ad2700137a9e2beb81145a433b5d16c0fcbf8fe79ba

  • SHA512

    410d52366122a1d8d48626a961e1d534bc72ac32f979fbdcda97abd0f278994c701315ccbf8c5a3101fbc2a59eddae61af155d91e095b5cfc6cb36bac366abe3

  • SSDEEP

    24576:fpomTTN9ttttttttttttttttttttttttttttttttttttttttttttttttttttttt9:Roo

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2