Extracted

• • Target

    2025-02-13_045b7c038adfcc63442ae9f1b2f2cf06_mafia

  • Size

    10.6MB

  • MD5

    045b7c038adfcc63442ae9f1b2f2cf06

  • SHA1

    8848e4415c6a291f43ea6c46d27ca1be40f2e1d9

  • SHA256

    219d932f434fc11445f50997d6e31fae837d7e73c21c72f08a04fc5aa256c918

  • SHA512

    001993c4b6ff4efac99eefccc3171fba234b645b91e0e627f1899ddff2a9338aeebe1576fb7f2f79dda297c37dc41415ce9d99dae304d8dfa0a261e5b82679b9

  • SSDEEP

    24576:OpomTTN9tttttttttttttttttttttttttttttttttttttttttttttttttttttttb:iooB

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2