Extracted

• • Target

    2025-02-07_3c18d492b070d12b0410b79cc5e04490_mafia

  • Size

    12.4MB

  • MD5

    3c18d492b070d12b0410b79cc5e04490

  • SHA1

    a55d2116d24a0e1d6b19bf7cab14c425bbae3c6f

  • SHA256

    5d24aa9379dfd9b590efd8e7346fef96609a3d09b99e2bf28ffd8fdc11f204fb

  • SHA512

    6de497b6d76c2b875b498a8b279c92a7539284880b28e9d5433653ade9bcd64ee4eaf5e337b240ef7320e29d0fe706c4109cdb41a67ffc64a7458408ef1d32eb

  • SSDEEP

    24576:uEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZD:HfotR

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2