Extracted

• • Target

    2025-02-07_dbfff9e34d05118cda16c2ef6289139f_mafia

  • Size

    12.6MB

  • MD5

    dbfff9e34d05118cda16c2ef6289139f

  • SHA1

    8cf2d8c5e46b84af2004b5e257fbfbdf50e50397

  • SHA256

    4879d688d33205178582eb559b0129a7cea53ceb8daed96a90825f3d389461c3

  • SHA512

    d0f236a8692b30039ceee5557a86a3203f97d13de4b670f3ce267158402a2898a1b9a56794160755720e4a73d7682e82267845e576730bcd53fccebcf7cb4b0d

  • SSDEEP

    393216:nXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXH:

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2