Extracted

• • Target

    2025-02-05_aa676bc79d7870c65da1fa38eb34c315_mafia

  • Size

    12.5MB

  • MD5

    aa676bc79d7870c65da1fa38eb34c315

  • SHA1

    85221d9d993f5e7f3bf14eccc9a4f62f30a0442b

  • SHA256

    b0ce21437725bd7d00729321d5710e429bf6b1bb3ac9303a03266a7a75672fdb

  • SHA512

    740e330a7bf9675ce04384d776d1e0d5905b4a804c343fbdbea56594d7e8a6b8f2dbb7e126a33ee8a9bb1fc4279e8bbd878d414d3810256b62c43683c61a4d98

  • SSDEEP

    24576:dpomTTN9ttttttttttttttttttttttttttttttttttttttttttttttttttttttt3:3ood

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2