Extracted

• • Target

    2025-02-13_e420639e928141fb52e3e7fadc0dbc29_mafia

  • Size

    14.0MB

  • MD5

    e420639e928141fb52e3e7fadc0dbc29

  • SHA1

    ea45e1fd71e302a70f2f84d6fde8d99527070e64

  • SHA256

    a920480bd38fe3e88cdc91dce7e3b736e3416d5e3d0e62cf6bc82962f4e5271a

  • SHA512

    d0d6389052dd39c1016acb39e49f5b7952dedabbfd3861a3ff29b9f007cd2b1c7dd608013d2f3f3dcd5e47294948d7f94795d0fe3b1669e54191b544202e4b63

  • SSDEEP

    49152:jLFuiE888888888888888888888888888888888888888888888888888888888s:jLM

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2