Extracted

• • Target

    2025-02-12_f3b1b2b1d0278d2b6208d20373fa71c5_mafia

  • Size

    13.6MB

  • MD5

    f3b1b2b1d0278d2b6208d20373fa71c5

  • SHA1

    4dde8a6c941614087573f4e298defc1c881e58df

  • SHA256

    a4287a992a3a033ee2751d0afe1f3461109c37550a7ab412bb34114581b231b9

  • SHA512

    f11b8f9fa2ed80835a741602365bd5f77591165dcaad2c5fc2cf08626137d2e355405dbc6f97d577866c5b34339a9ce21a6d1aee9b636f1283e9f52329095d57

  • SSDEEP

    24576:t/0dLk3X4ICvkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkT:F0dLk3ohc

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2