Extracted

• • Target

    2025-02-12_e781a1bcdb8852c0f8cf2da6a6331cba_mafia

  • Size

    10.3MB

  • MD5

    e781a1bcdb8852c0f8cf2da6a6331cba

  • SHA1

    75680e24b2ae2cbd42bdb2b25f016489c5c6a539

  • SHA256

    d296b7c77676b8123039d3e50eb3d651ccfe9731bffca01a64563c32e2f70dc4

  • SHA512

    5b6f6b20b854a1c3f40481140d8591da2c4343cd67a7381835bb568539efd5926191ccd3da554c14c0f2904c8b63a70da0d9e88f6cb05a79cf40e2b63fc60db7

  • SSDEEP

    6144:VLQ1p/2p5e+D2jFHO+iZoy6u9FlfrXEz9NQNQNQNQNQNQNQNQNQNQNQNQNQNQNQR:mTYe+D2jFu+iZoUFhAzc

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2