Extracted

• • Target

    2025-02-04_0db501e7b298021edd67675de8df86c6_mafia

  • Size

    10.3MB

  • MD5

    0db501e7b298021edd67675de8df86c6

  • SHA1

    53469a8b6976a59d14b07348105a9a6271f71d96

  • SHA256

    96dc271c4e954a7e65146eaef6435c6bb4c868f612bf46880bf583128740de34

  • SHA512

    d84c6298db4ee534be0941d69632b1644c74fac2ff73f00858d297d9c1969107d8192bed04e6eac96c4a9e37617ccae927bd16cf740cea2719e7e66f11826418

  • SSDEEP

    24576:UEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZr:xfotp

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2