Overview

overview

10

Static

static

9d71a3a135...83.exe

windows7_x64

10

9d71a3a135...83.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9d71a3a135f9e3b9de7024d85f1c59f809796db6114974236462740f262c6c83

  • Size

    14.9MB

  • Sample

    201115-zdvldrb5hn

  • MD5

    8d70d33692835a054cc3d98b593dd05a

  • SHA1

    bf1cec9d3ab53be4827076e2d15313e6fe8e99e6

  • SHA256

    9d71a3a135f9e3b9de7024d85f1c59f809796db6114974236462740f262c6c83

  • SHA512

    cf9536aea51c3d22385323ea4401d55570dd3235daf202d9775c4d3c223e38d56e48c20e07858f2ce086d080dad1cf5a19a1abd590b3728794775609a9f7996f

Score
10/10
tofseeevasionpersistencetrojan

Malware Config

Targets

    • Target

      9d71a3a135f9e3b9de7024d85f1c59f809796db6114974236462740f262c6c83

    • Size

      14.9MB

    • MD5

      8d70d33692835a054cc3d98b593dd05a

    • SHA1

      bf1cec9d3ab53be4827076e2d15313e6fe8e99e6

    • SHA256

      9d71a3a135f9e3b9de7024d85f1c59f809796db6114974236462740f262c6c83

    • SHA512

      cf9536aea51c3d22385323ea4401d55570dd3235daf202d9775c4d3c223e38d56e48c20e07858f2ce086d080dad1cf5a19a1abd590b3728794775609a9f7996f

    Score
    10/10
    tofseeevasionpersistencetrojan

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • Windows security bypass

      evasiontrojan

    • Creates new service(s)

      persistence

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Modifies service

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks