Extracted

• • Target

    2025-02-12_15055d52f68bc24f7d3ac6775bcb263f_mafia

  • Size

    13.4MB

  • MD5

    15055d52f68bc24f7d3ac6775bcb263f

  • SHA1

    90c9a1751a8a180dbe82729ecf99af1a41413a8e

  • SHA256

    8a5f5f10a5dc3a7f0e8cd55b65906b0fbe334ebeb5836ddfc7ffbbaec6b6c01e

  • SHA512

    13f48c731e696495494838fd642617387b463cfb845d0e18c7ca324225cd023105076295adc789a1ad41a6ebaaf47b43880a122e0263c45aa71b56f6d5a64663

  • SSDEEP

    49152:jqENTT4HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAL:jqIT

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2