Extracted

• • Target

    2025-02-07_baa3d4ecef961095880f238de0e0be22_mafia

  • Size

    11.6MB

  • MD5

    baa3d4ecef961095880f238de0e0be22

  • SHA1

    c59ca1d96a298bb7cd32d8e74b5f0e6b9a8ec2c3

  • SHA256

    3731776b9bb93158e5eeaf11d9d13588fd9509d0879fad0fc6aff8a20c6ce6d2

  • SHA512

    9967fd6125d449931142378d77af25f8ef3edf7eab6341ecdef79ed6cb7c7395b216aa59768471dcd105150615e4f78239be45e4a7ba4dbed4ec2b524df08c75

  • SSDEEP

    49152:GqE0YKr3fYPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP:GqtYc3

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2