Extracted

• • Target

    2025-02-08_531e61003ca651617f61f707d2487d70_mafia

  • Size

    13.6MB

  • MD5

    531e61003ca651617f61f707d2487d70

  • SHA1

    534933e36aa862215c190989e161fca87b27c53c

  • SHA256

    cc9470d2336b15fbb0c692b90d9bc19c26140f98c2422969ac1d223d262f5ee2

  • SHA512

    4afd9ff2de2688cf81b6678b4b9c4c0b3ae8d94ff37a04420f45f951bf848fb9f66a2e21b04d0d888e82aac8f207b2544bd2a88d4c7481b3a11c4402dddf7108

  • SSDEEP

    24576:hpomTTN9tttttttttttttttttttttttttttttttttttttttttttttttttttttttn:7oo

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2