Extracted

• • Target

    2025-02-12_3f40b43a6f34a4c1e3c7c0e82a0f01bf_mafia

  • Size

    11.2MB

  • MD5

    3f40b43a6f34a4c1e3c7c0e82a0f01bf

  • SHA1

    ce7621d238145db55ab052550e4b0e206fb770ae

  • SHA256

    df9274a5d24f3da8be705766865bc91f8dea15a89bf77e9bd95df0f309e0923e

  • SHA512

    11a48693a1a5e861c98d6d1c2429f041b0d4356683affbfcc62924a847849143813b9caeef11a3f16bc2a1b9d7774a005330bedabadf7702a41b4fd9cefc6ad1

  • SSDEEP

    24576:kEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZr:BfotJ

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2