Extracted

• • Target

    2025-02-07_2f2f89e2b33d2f20ebec6be976256c40_mafia

  • Size

    10.9MB

  • MD5

    2f2f89e2b33d2f20ebec6be976256c40

  • SHA1

    2af56019e0f723893eececfbb11f59f465b1a75f

  • SHA256

    62ca5f1905eb749a4e3ffd61addfb03585a7b4159510e776c3872436c2ececdb

  • SHA512

    9a132b447bee185baeb62ee525af1083afa24cf9b16fdfa871ce343922341d1cc1a71f38652f0b700057d9673e16fa8999108b20971a185d3cad2f7cafdc3331

  • SSDEEP

    196608:KyXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXH:/XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2