Extracted

• • Target

    2025-02-03_9680b32c7fe1e783dd87dd9c0c82b5d2_mafia

  • Size

    13.6MB

  • MD5

    9680b32c7fe1e783dd87dd9c0c82b5d2

  • SHA1

    6922e45f8c4cab77ec15e36a58340dd54718f813

  • SHA256

    4d30e4f325b8b087db2224633cfaee430cd2aaa42c1dde8532e45906ab087e51

  • SHA512

    17ba622318af9bdff22d92f52706c89d15b33f0f7741731cde9f3449ec245582c61a9299067192153a1194f853bf0ce1999912d3fc6f3355ffcbab2df87cc731

  • SSDEEP

    24576:t/0dLk3X4ICvkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkn:F0dLk3oh

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2