Extracted

• • Target

    2025-02-04_23554a2f22469025da86734caf4c8d02_mafia

  • Size

    10.1MB

  • MD5

    23554a2f22469025da86734caf4c8d02

  • SHA1

    6cd1a8d6e596578b8f00de2e0f025812831f72ae

  • SHA256

    ac41ea8c3aae68538ecc8288ca53b92b4044328fed0dae0034a5b0204dc003b9

  • SHA512

    1d05be4d0dbd19f6965e3fed6d681f94e99ca44e06eff0745c1842e6e0e0af5afaaa7aa553c5233808ac31cf59cb4f1fa349797e22f6032c6f465653fe802170

  • SSDEEP

    6144:ZLQ1p/2p5e+D2jFHO+iZoy6u9FlfrXEz9NQNQNQNQNQNQNQNQNQNQNQNQNQNQNQI:6TYe+D2jFu+iZoUFhAz

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2