Extracted

• • Target

    2025-02-13_2caa5dc4354f6e8da910c0914921bb6e_mafia

  • Size

    12.5MB

  • MD5

    2caa5dc4354f6e8da910c0914921bb6e

  • SHA1

    8b2c8f2a0ddd71d875b51482563f1ccf5478acec

  • SHA256

    b40f3f7f3e90e05e89b216f066aad486c83e27891c4bbacf77e9f134561e2bcc

  • SHA512

    2f89ca08502440798fa6098e158997845269c3f632fc6948271ce5ec876b4036e5e79137757473f378384d26c8df34967b0a3f78378b5bce6cacdc7f75b410e7

  • SSDEEP

    393216:+XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXs:f

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Windows security bypass

    defense_evasiontrojan

  • Creates new service(s)

    persistenceexecution

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2