Extracted

• • Target

    2025-02-07_b10aa5bc73f65cf6252bca38fb5763fa_mafia

  • Size

    10.3MB

  • MD5

    b10aa5bc73f65cf6252bca38fb5763fa

  • SHA1

    52ad45d0b072c40fe7316eb9113b5f4467c7e839

  • SHA256

    f2d21e6c301447b4e60fd647c5e054424006507a393edcf6a9f4555f887e8506

  • SHA512

    2ac37c84ce560eaee6b577bfafb2de5ae9344cba5b85fad40cff46d7ecb0a254c715fedd9c846f83770f53f700e5aa4e3aaae54f186932a03e7de0e546a29656

  • SSDEEP

    49152:NqE0YKr3fYPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPO:NqtYc3x

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2