Extracted

• • Target

    2025-02-12_256fd0ad910554ebb8e9e8b11932eb27_mafia

  • Size

    11.6MB

  • MD5

    256fd0ad910554ebb8e9e8b11932eb27

  • SHA1

    b5c305e5408ac1e9b1cde40f6753f8f5da647270

  • SHA256

    f0ca97925d5e6e0386791d31e7265098e154d852dfa0b0f275bf448a1410e1da

  • SHA512

    3c7a361f1f76c0c74ceeb36151ffd8cdcdc7ccb9086c1778cecf4c62ea1e846868edc5409ec07797b1aa52c96059c6acacc2d075471e53b6fe92da177dc132e1

  • SSDEEP

    49152:GqE0YKr3fYPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPV:GqtYc3Q

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2