Extracted

• • Target

    2025-02-08_63d1d57985863177aff31922317e6a2d_mafia

  • Size

    12.8MB

  • MD5

    63d1d57985863177aff31922317e6a2d

  • SHA1

    a9e1d61beb6148cfe8f34eb18cbd750a1fcc94f6

  • SHA256

    faa27c56d471b15784ae7ccde9f7ae0ec110e6258f3f0aa1ca6acb5bd3d89094

  • SHA512

    d10c1c6077eed6955cfc404f32cdd7a140e7eeed965f458692e7e3f59f90e565b76b46897f733af2971f2908dcda5d7795593a7b3fac08d53a8e298d0e3de9c2

  • SSDEEP

    49152:dqE0YKr3fYPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPY:dqtYc3v

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2