Extracted

• • Target

    2025-02-12_c0ea46531ef89f3e62437bd391ee4dbd_mafia

  • Size

    11.7MB

  • MD5

    c0ea46531ef89f3e62437bd391ee4dbd

  • SHA1

    ab76acd72df5c8685a6013c0f6abceb7a84937fe

  • SHA256

    40cef83656d2e4caf62d59afb7148fbb962df595455ac368dfb279f34bba1f55

  • SHA512

    422dd1e02594936eeb6a89cbb88a3f4ef01d170e4e95c5dd06cbcf376f041ff3811a89430690d8399f74bf5174cc76ae79a9bd8d19f38f4398350ec85c59ba84

  • SSDEEP

    49152:nqENTT4HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAX:nqIT

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2