Extracted

• • Target

    2025-02-05_894a9eefc5b05d243238afed2b573167_mafia

  • Size

    13.1MB

  • MD5

    894a9eefc5b05d243238afed2b573167

  • SHA1

    7dc5bd6b457cac8c2b5b6ff3edc1ba5eb3d97a82

  • SHA256

    a5e7d70a29f30a9d82c922a5e49eff12db1d47772fceb8012988b4d6001a7b02

  • SHA512

    00fd31f17cef02f5f45156398e1a074230aa0e0383cddca5b2ca6daab68716da29db90d5d26f5f236dd0c795dd5d8870e903cc8ac833890efa8943a0a71d5818

  • SSDEEP

    24576:aEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZn:zfotN

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2