Overview

overview

10

Static

static

b66d115512...77.exe

windows7_x64

10

b66d115512...77.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b66d115512ea956db9993f91a3349777

  • Size

    14.0MB

  • Sample

    201214-63q3h4g182

  • MD5

    b66d115512ea956db9993f91a3349777

  • SHA1

    113b9cffc62fdced336e71ce7dad47e4649acd01

  • SHA256

    92d58ed3de4b25d0508ca5b3afe6ef6c5e4e15eed2779986d6940126e7eecfda

  • SHA512

    24cd97820000849f3034f6524943e8a06c0b88b34a9ea6254d3b730044b92f66f738a72d02265d1be2019905a032528c4005765c611abc57cdaefae5d474e22b

Score
10/10
tofseeevasionpersistencetrojan

Malware Config

Targets

    • Target

      b66d115512ea956db9993f91a3349777

    • Size

      14.0MB

    • MD5

      b66d115512ea956db9993f91a3349777

    • SHA1

      113b9cffc62fdced336e71ce7dad47e4649acd01

    • SHA256

      92d58ed3de4b25d0508ca5b3afe6ef6c5e4e15eed2779986d6940126e7eecfda

    • SHA512

      24cd97820000849f3034f6524943e8a06c0b88b34a9ea6254d3b730044b92f66f738a72d02265d1be2019905a032528c4005765c611abc57cdaefae5d474e22b

    Score
    10/10
    tofseeevasionpersistencetrojan

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • Windows security bypass

      evasiontrojan

    • Creates new service(s)

      persistence

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1
T1050

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

New Service

1
T1050

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks