Extracted

• • Target

    2025-02-07_c2852932f1ca29aeedd95eaf207fefa0_mafia

  • Size

    10.3MB

  • MD5

    c2852932f1ca29aeedd95eaf207fefa0

  • SHA1

    30b20c6e0a97f88d03ae9afa014e54c759c2e719

  • SHA256

    ddb15f06bcdd564fa338a83939d20cb6a09a78dbba5ea6fd369ad7d38a1c9c39

  • SHA512

    d30b16acb0fdfb2f872161363f8ce4021a29126eae8e4ba1585c5d08c5937c751c7029dc78709a72984b18076e6708d2fc3bbb3217834c44dde455e72b34ef5c

  • SSDEEP

    24576:lEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZT:ufot

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2