Extracted

• • Target

    2025-02-12_b5f5869e710e443196fbcbac5a5b8ca0_mafia

  • Size

    12.8MB

  • MD5

    b5f5869e710e443196fbcbac5a5b8ca0

  • SHA1

    f2bfb31da282319b38bda917e58513062199939a

  • SHA256

    c1d3875af33b5d1cf77b3c21d6cb9c262602d45a57531c319fa36bafb129ff66

  • SHA512

    149ca3c468ee38aa4ddda83e4f62002f6dcfa35da395d215f2cae754d726292ea5beede098e45c7294c148b2d32b4c5a43c1aa26f5e225f45efa9a50911781f3

  • SSDEEP

    24576:cpomTTN9tttttttttttttttttttttttttttttttttttttttttttttttttttttttq:4oo0

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2