Extracted

• • Target

    2025-02-07_9d5863a9ae43e0ca1a631bce9f0f8abc_mafia

  • Size

    12.8MB

  • MD5

    9d5863a9ae43e0ca1a631bce9f0f8abc

  • SHA1

    d068e742cd0a0b717ff6ee23b09b75a5730c0947

  • SHA256

    5c6e2601359a3f22947a7e94f63aa0d6c0408f069f3846f11a7efd6889642d35

  • SHA512

    9cc601348648b40ce12cc5166b61eca0bddfe898792b9ce0fc9f487be7f2d040b0a95a3d3e1bdf3b94c30b909c4f82ad02db121079303cc1850dcf856e958cdb

  • SSDEEP

    24576:4EfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZv:1fot

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2