Extracted

• • Target

    2025-02-12_d4d06f61b30f2eb96fc9304abb1d53da_mafia

  • Size

    11.0MB

  • MD5

    d4d06f61b30f2eb96fc9304abb1d53da

  • SHA1

    b2fd5fbb32b885895f1b48e132d9dbeb687b4260

  • SHA256

    f9e43e02d3b44f3821261a9937ecca6344f5ed2f5babd6092dd9ce17d7ba32f7

  • SHA512

    da03da41fb389269762211c0cd8bd7e9ab29d03566c876a0fe512e66d27717e3020eb001c4e773b26b27e979d12923b700e5bfac6aec336c09b2b734973cd53c

  • SSDEEP

    24576:FpomTTN9tttttttttttttttttttttttttttttttttttttttttttttttttttttttM:vooa

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2