Extracted

• • Target

    2025-02-03_99c64ff1e1f52348d4b7dbbf5a0632f9_mafia

  • Size

    12.9MB

  • MD5

    99c64ff1e1f52348d4b7dbbf5a0632f9

  • SHA1

    12eece8338d93ed9dd22903f4e6c64d8e6f6531a

  • SHA256

    87a0db19083558b7383108d51b80eb6505f25d869dfd6c36ba9e66292d74a490

  • SHA512

    7eabb767096cb2cd25a019470018f7e69a8bb75872970eea7cb5aabb4bffb84d11261df95e7f619a4c5562ab893928ef69d38d40ed87c65d360eba3594d3176e

  • SSDEEP

    24576:W6WdLQkyQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQY:XWdLQk

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2