Extracted

• • Target

    2025-02-05_0b402788ae36bf573d6e69354c37f310_mafia

  • Size

    11.1MB

  • MD5

    0b402788ae36bf573d6e69354c37f310

  • SHA1

    7e6265eebfb3fda97e75837d6376fa1386e603b8

  • SHA256

    a737bd18b9e6f84a049a7a74b4e746729bf8a60caba2267d86f468ee20a7409d

  • SHA512

    dd68e8e92ebc8a955149c539df14e4b34276b51c7a1df8233a0a7923a3ac565417dbdf0b0e834ad62198382349dfa23e66994fcf641fea8f8c09f19917ce67e8

  • SSDEEP

    6144:cLQ1p/2p5e+D2jFHO+iZoy6u9FlfrXEz9NQNQNQNQNQNQNQNQNQNQNQNQNQNQNQG:RTYe+D2jFu+iZoUFhAzH

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2