Extracted

• • Target

    2025-02-06_f3eda9233b9866583638eab9a80cd886_mafia

  • Size

    13.7MB

  • MD5

    f3eda9233b9866583638eab9a80cd886

  • SHA1

    be8b2ac167a03f073d2a2a26e849c5fcda57e4a7

  • SHA256

    c9e8b3cc85721662eb296b73db92b2029a1ddf4c3e0ab32e876ab50eaee72f33

  • SHA512

    bfe3efcdf0e58624cf5f531e6ebeb1ce500c26e52b1b54c5bab13ce7baf7cde736e43b5baa81c0b3d540b9932f347935f704f221b2c336ade12da515f54f80b4

  • SSDEEP

    6144:7LQ1p/2p5e+D2jFHO+iZoy6u9FlfrXEz9NQNQNQNQNQNQNQNQNQNQNQNQNQNQNQL:QTYe+D2jFu+iZoUFhAzU

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2