Extracted

• • Target

    2025-02-06_e4ebdc82b67d3ae68d35c44c001d69f2_mafia

  • Size

    15.0MB

  • MD5

    e4ebdc82b67d3ae68d35c44c001d69f2

  • SHA1

    1ffedc166d7cc7f026d16ffc66ef654b395c79c9

  • SHA256

    12d4bc95b3a631de6f5087f8cc4080ae4382a0d5397612ac1fd87ed570b162a8

  • SHA512

    509ad39d0c25ea1db6d2463de4033b755f7a0e5b3fbfc1281a6c85fde284946261d0b6be89de50788bacfdebdce738c42e924ed479519d8af8aafd79acacfe71

  • SSDEEP

    49152:4qE0YKr3fYPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPj:4qtYc3k

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2