Extracted

• • Target

    2025-02-07_9f3b270d0a461fe86d593c868794751b_mafia

  • Size

    10.3MB

  • MD5

    9f3b270d0a461fe86d593c868794751b

  • SHA1

    f36ef7f1d36c82df8af9a45f9ce4bb49dc04073e

  • SHA256

    9debc8fd1f6a5f6578dc309f1d21f77a907b14d0aa763e56448b1fb3070f9ffe

  • SHA512

    3f8a1204227b28a95cdf401c1258719056d458ac5d756eb1dd32e081fdf084fabaff0b1e0cd58a48f267fa18ecd1abd94e5db11bb7348706c591f8b28328299c

  • SSDEEP

    6144:VLQ1p/2p5e+D2jFHO+iZoy6u9FlfrXEz9NQNQNQNQNQNQNQNQNQNQNQNQNQNQNQS:mTYe+D2jFu+iZoUFhAzF

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2