Extracted

• • Target

    2025-02-07_25f94a1dbecc910c55ed29e07ac9cbca_mafia

  • Size

    10.5MB

  • MD5

    25f94a1dbecc910c55ed29e07ac9cbca

  • SHA1

    815fef0d0f484888a31c977a90742402d4381209

  • SHA256

    f4b051a98e3de375971e1a0023b799b771cc856b1ae4a6bdf29cb50415f42900

  • SHA512

    7194750de0c3745dd6b19fec8aea1297069b730ab79557ed1f5010a8739c3996490d18828578822019bed3193e3dec01ac6c1523221d0fda5dba5adcfaf1b97c

  • SSDEEP

    24576:ZEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZV:Sfot

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2