Extracted

• • Target

    2025-02-08_afe5e92231cb021e4c98b66c1f97a92e_mafia

  • Size

    12.1MB

  • MD5

    afe5e92231cb021e4c98b66c1f97a92e

  • SHA1

    ab95c90122d5405dd919c39069fd8135b3695677

  • SHA256

    d5e66820b485fc36d65e5fb1082aed954d234c4102c6196d643cd7ceb1bf8f67

  • SHA512

    5eb76983b86c354eec73ca6948146929ce62ecebf2ac7a353214f3a2d2dbd688689fb27053ac097b6d1b2f41502e56c427e6454bb39cafd71d9606aa00485e84

  • SSDEEP

    49152:pLFuiE8888888888888888888888888888888888888888888888888888888885:pLME

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2