Overview

overview

10

Static

static

bab6c47622...67.exe

windows7_x64

10

bab6c47622...67.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bab6c47622956b5426c17793f90b2967

  • Size

    10.6MB

  • Sample

    201214-betqqcamsa

  • MD5

    bab6c47622956b5426c17793f90b2967

  • SHA1

    f1e91228dd2812d7a6f733a1e1948efed8076007

  • SHA256

    ac64da9df016c09cae0d4ee89dfb245c39b8347e3314f638733a6ddd6ae33bf4

  • SHA512

    fe4a05a1ae2174cc62cf293bbaac6a8c34995a0d10067972069aa3d374f199a18f1700225e7d361fba1ab1869af59d47c958abe90ee830226f654eefe2cc6bbc

Score
10/10
tofseeevasionpersistencetrojan

Malware Config

Targets

    • Target

      bab6c47622956b5426c17793f90b2967

    • Size

      10.6MB

    • MD5

      bab6c47622956b5426c17793f90b2967

    • SHA1

      f1e91228dd2812d7a6f733a1e1948efed8076007

    • SHA256

      ac64da9df016c09cae0d4ee89dfb245c39b8347e3314f638733a6ddd6ae33bf4

    • SHA512

      fe4a05a1ae2174cc62cf293bbaac6a8c34995a0d10067972069aa3d374f199a18f1700225e7d361fba1ab1869af59d47c958abe90ee830226f654eefe2cc6bbc

    Score
    10/10
    tofseeevasionpersistencetrojan

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • Windows security bypass

      evasiontrojan

    • Creates new service(s)

      persistence

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1
T1050

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

New Service

1
T1050

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

2
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks