Extracted

• • Target

    2025-02-07_da2967acc7a5340411d229fc740da703_mafia

  • Size

    11.6MB

  • MD5

    da2967acc7a5340411d229fc740da703

  • SHA1

    34791d2052ae9ae0d86b16fbe95cc3601a231e27

  • SHA256

    164f30013a9f0b91c974b2e06e2bd5f850b04d2fcf8d51d47ee8b3cf12e5e011

  • SHA512

    00568eed6ad8ae23ca064e8e5c79983ca673fc3ce7e7cae944bc04c3a5d6d3f5ccae61de604d4c6386d3723515da1e9bf3864ba93e0bafbd29ff91eb7a2b20b3

  • SSDEEP

    24576:I6WdLQkyQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQI:VWdLQk

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2