Extracted

• • Target

    2025-02-08_33dc12075f473b3166c8833cc3b633a3_mafia

  • Size

    12.5MB

  • MD5

    33dc12075f473b3166c8833cc3b633a3

  • SHA1

    a8125c7aedaef0fce311103670984850b397733a

  • SHA256

    18961d594d2fc621dc82f9f3af5e5e92ff86b7043a1808c90566d406b357ffba

  • SHA512

    f5599030895c4c87c04a55890b2a9fcd1c75fb296850af67cd3070b8167b6de9ace2c7fb6e3fbbaf9183aac2c6073878886db75b23f245f0fa1c523074e25b01

  • SSDEEP

    393216:CXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXn:

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2