Extracted

• • Target

    2025-04-04_4a5bb2d70a4987b0e89849ec6662f650_mafia_rhadamanthys

  • Size

    12.0MB

  • MD5

    4a5bb2d70a4987b0e89849ec6662f650

  • SHA1

    defff87d43d81bd0dc3f5a7b3d1842e255463fa7

  • SHA256

    a305617dbb44b3423aaa930ed5133743c6164f38bf1b53e2880d2c3f66875d74

  • SHA512

    a604c539832b09c0d941942a92333ccff28bd0ca996380c65c3b80587806599c3b9d30c765a9b3a7667ad7bed432c18ca141fb1a769771ebb6e27c9c4a9d1a16

  • SSDEEP

    393216:UXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX3:

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1