Extracted

• • Target

    2025-02-08_accf8d716b789cd50ea56708bd19b0a4_mafia

  • Size

    12.8MB

  • MD5

    accf8d716b789cd50ea56708bd19b0a4

  • SHA1

    d9db26522635830d851f5a29be7798b4e299404e

  • SHA256

    e29f2c55481aae49476f4eed302cf7aeb98d1b3efc050220378a944fadbb5d87

  • SHA512

    7c2adf752c75fd5d0f6a65e5ebe5e0ac492fd844dba53771915d031c66d44870ccd85a9f6e324dd7fb04f5c0b084b5b1fb5b7ed7d3cdcdefe1332b0b284544d4

  • SSDEEP

    393216:TXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXH:

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2