Extracted

• • Target

    2025-02-06_e1a41009719f24351fdb86cb08327975_mafia

  • Size

    14.5MB

  • MD5

    e1a41009719f24351fdb86cb08327975

  • SHA1

    e926304291d60be6fdc8a5d4fbe912789a576120

  • SHA256

    77288fcd3e18e83fc6bfcfb138f229bcf224ea580a731ad7da68e48d4efc0c2f

  • SHA512

    eac60911b15fec1f4fbb10103091f48c5aacfc7b41378d857c37856f97d1927cae70f5d4bd27e46575f0c2f06a465236a41646908a5841e7a4d5c58c6660ade7

  • SSDEEP

    49152:dqE0YKr3fYPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPy:dqtYc3h

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2