Extracted

• • Target

    2025-02-05_bbfcd3ad74dc8c29d82d24e4d52c5f45_mafia

  • Size

    12.9MB

  • MD5

    bbfcd3ad74dc8c29d82d24e4d52c5f45

  • SHA1

    8801850748535f0406395ab864a20c3ee04cf464

  • SHA256

    94871a96c6d6fb66be233acb65d6f6de8bed474500a18071174b75d8eaff3971

  • SHA512

    3e8aa772814cb8edb2973db7243fcfbe609cf1b2fc2d9449df237f5fa3ea673cc948c54a67df1fbe5f6054c4607c668335a48aeecc575da04ca0ec8bbc19be33

  • SSDEEP

    49152:XqE0YKr3fYPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPb:XqtYc3q

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2