Overview

overview

10

Static

static

2c186a17b4...e1.exe

windows7_x64

10

2c186a17b4...e1.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2c186a17b4e8362e5ddd55713ff2a680c08792c6a6f84f7cc468db7e843535e1

  • Size

    11.3MB

  • Sample

    201115-nj9fw45kgn

  • MD5

    4a392cb957115db7e044bd2990db7375

  • SHA1

    244b7bf7c054604db905801bea177bb49a3994a3

  • SHA256

    2c186a17b4e8362e5ddd55713ff2a680c08792c6a6f84f7cc468db7e843535e1

  • SHA512

    d60de22233029ac31fbe5e9eac1033125f0ab1faa967a0ea63e167586df2785314365087f154dbac324da509d119ce383f1c9a9ef93f4c7161d0f5a5a4650054

Score
10/10
tofseeevasionpersistencetrojan

Malware Config

Targets

    • Target

      2c186a17b4e8362e5ddd55713ff2a680c08792c6a6f84f7cc468db7e843535e1

    • Size

      11.3MB

    • MD5

      4a392cb957115db7e044bd2990db7375

    • SHA1

      244b7bf7c054604db905801bea177bb49a3994a3

    • SHA256

      2c186a17b4e8362e5ddd55713ff2a680c08792c6a6f84f7cc468db7e843535e1

    • SHA512

      d60de22233029ac31fbe5e9eac1033125f0ab1faa967a0ea63e167586df2785314365087f154dbac324da509d119ce383f1c9a9ef93f4c7161d0f5a5a4650054

    Score
    10/10
    tofseeevasionpersistencetrojan

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • Windows security bypass

      evasiontrojan

    • Creates new service(s)

      persistence

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Modifies service

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks