Extracted

• • Target

    2025-02-12_3282c73e006d7ac56222da1498668f06_mafia

  • Size

    12.3MB

  • MD5

    3282c73e006d7ac56222da1498668f06

  • SHA1

    14f7bcf5e57d34841387db082da3dd9bbb9af0b3

  • SHA256

    39686750872f865dafa4bfee49ae339567da052faed6667322eb386c2a374a74

  • SHA512

    655f455f05fa9d76c73da5f5b752003617fb946a6d3579e35adcd31e3103f313050deafbb41d2f1b81c5101f9d1af49b3a1edad92a36d47e1af99c0b3ea8dd1d

  • SSDEEP

    6144:yLQ1p/2p5e+D2jFHO+iZoy6u9FlfrXEz9NQNQNQNQNQNQNQNQNQNQNQNQNQNQNQ9:zTYe+D2jFu+iZoUFhAz

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2