Extracted

• • Target

    2025-04-04_383149c0caa91af2b739b5b7c2f3dcbc_mafia_rhadamanthys

  • Size

    13.1MB

  • MD5

    383149c0caa91af2b739b5b7c2f3dcbc

  • SHA1

    b7915c9b62b544188bf2f37ebbb70f8a12ed6416

  • SHA256

    6dd1b05af499bfaae6985c03b6cdf53ec443e7a171e95923cb46672e285c23e3

  • SHA512

    d2bd65cb5b6ee8232a78ed6bb7bac8c0bdd3d83bac654418e18c8e7f50e148f408ca812873146c443e4b828e4f18444d6a222bb5d73114135c8d89e8c13aae7c

  • SSDEEP

    393216:GXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXd:a

  Score

  10^/10

  tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee

  • Tofsee family

    tofsee

  • Creates new service(s)

    persistenceexecution

  • Modifies Windows Firewall

    defense_evasion

  • Sets service image path in registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1