Extracted

• • Target

    2025-02-07_c2f6f00745bf29b245f3c1a7434b3aba_mafia

  • Size

    10.8MB

  • MD5

    c2f6f00745bf29b245f3c1a7434b3aba

  • SHA1

    ed9c25ad7141939c366fe291b3cc37d1a66d78dd

  • SHA256

    ce3075a1f82aa948518f19102b1bac1b980e9f6a053b878702ccd123681fb046

  • SHA512

    8dbc22df444f75d5cd69471e48ebf643844bc76cd37ba4f14b990b0d7bf5d92075b249fde8389854cea97b575acdd8f58c2bff91ab716c0b266926f3dd6dd5c9

  • SSDEEP

    196608:5yXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX3:0XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXH

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2