Extracted

• • Target

    2025-02-07_5d23f9f8c2dd57d2506e7e24907662bd_mafia

  • Size

    14.1MB

  • MD5

    5d23f9f8c2dd57d2506e7e24907662bd

  • SHA1

    19d072911ed6bb3e851e66093130eb9d23e80b69

  • SHA256

    833468580dd0ec785d04db7cda97f798af7095393619289a44cfd28d6814a37a

  • SHA512

    f6d9e97af6f3ee4ad045ab308776ec3134489598e4bfc71c58334f3eebb6eddfb7a937fe3b5b4ac205612fbf4a4a26ca02258017f307824291088de572f980f8

  • SSDEEP

    24576:MEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZd:Jfot

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2