tofsee | aa95f8cd1b28d2d1065ac290edc78f0ac8d00b3863f52c084a06155202d96c0a | Triage

Sharing

General

Target

bbb0a4f942a2b080cdf71bc38a8518a8
Size

12.2MB
Sample

201214-g5t2ef942e
MD5

bbb0a4f942a2b080cdf71bc38a8518a8
SHA1

70b3fc91640e9f9867adf924ead9290023cfae4c
SHA256

aa95f8cd1b28d2d1065ac290edc78f0ac8d00b3863f52c084a06155202d96c0a
SHA512

3cea9d0a723ed744d6fe5afb1c7c4f745efe9565ebc1acf532eba983feab25ce2b9940d980b1e7a8d67d15c0142e3b74cb57344dd95e561ce3d8b7d465a7e470

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Targets

- Target
  
  bbb0a4f942a2b080cdf71bc38a8518a8
- Size
  
  12.2MB
- MD5
  
  bbb0a4f942a2b080cdf71bc38a8518a8
- SHA1
  
  70b3fc91640e9f9867adf924ead9290023cfae4c
- SHA256
  
  aa95f8cd1b28d2d1065ac290edc78f0ac8d00b3863f52c084a06155202d96c0a
- SHA512
  
  3cea9d0a723ed744d6fe5afb1c7c4f745efe9565ebc1acf532eba983feab25ce2b9940d980b1e7a8d67d15c0142e3b74cb57344dd95e561ce3d8b7d465a7e470
Score

10^/10

tofsee evasion persistence trojan
- Tofsee
  Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
  trojan tofsee
- Windows security bypass
  evasion trojan
- Creates new service(s)
  persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Sets service image path in registry
  persistence
- Deletes itself
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

New Service

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

tofseeevasionpersistencetrojan

behavioral2

tofseeevasionpersistencetrojan