Extracted

• • Target

    2025-02-07_988e4c015a0e26ef49408fe8d7dd8128_mafia

  • Size

    12.9MB

  • MD5

    988e4c015a0e26ef49408fe8d7dd8128

  • SHA1

    b05c15ebd878390e309f887accd405614d7bbfa3

  • SHA256

    483792510effe9b4c4085d1962caae4aa93547ebd91006a68de0b8745617c154

  • SHA512

    ed2495b187f10adee5316af0a054718862b978f712a32724d4456196b0d3f4d7505ed5b2cf54ab32bb4ea8e2dc3c3cae2bb4c3dca3e67c6c5f88079f3f0af86d

  • SSDEEP

    24576:upomTTN9ttttttttttttttttttttttttttttttttttttttttttttttttttttttt9:Coo

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2