Extracted

• • Target

    2025-02-12_278371f1b211d7246e41ef85ce0687bf_mafia

  • Size

    13.9MB

  • MD5

    278371f1b211d7246e41ef85ce0687bf

  • SHA1

    b3c811fe19c18dae6e4ac9d8343fdc37b5c96f01

  • SHA256

    c5b780261d14ffb7b0c9e250ac65dfcb5b669811fa9a49d4a0057ae7bb972cb3

  • SHA512

    7e557b2586abdbbcc9ded12775f7c696bedc8bc6f21ecbfed814009c029455ac529cf50934175fb4a1f073f079ff5b85bf08973c80678841dcc9aee56908e866

  • SSDEEP

    49152:bqE0YKr3fYPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP6:bqtYc3n

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2