Extracted

• • Target

    2025-02-04_1a821c79b1db287d1949eca62a75f5f4_mafia

  • Size

    10.1MB

  • MD5

    1a821c79b1db287d1949eca62a75f5f4

  • SHA1

    d9f36db1c8661263c3c7353ab4a3827905b3febb

  • SHA256

    6b7dac036e7c0230178bd92e96534c68b38c47ab3fbf9d7137ba1836c0941443

  • SHA512

    ae45b3e9ee6b1731c4dd27e17781d9333fe2273b531628d4f602f39dbd14b19b99cdd53ab053da4a92f55138bb5ef89925167552ca4f1d23c2fa2884a54908bc

  • SSDEEP

    24576:0EfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ1:Rfot

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2