tofsee | b36c42fd589f6eeacc8f5b4fb21b37c4eef8bd1a8a8a737d8e7e8d09f9f6e1dd | Triage

Sharing

General

Target

f14a46d2d5535867d84aa11fa8ae5c2c
Size

10.2MB
Sample

201214-zf57vkvyjn
MD5

f14a46d2d5535867d84aa11fa8ae5c2c
SHA1

39d19968f1106dae2917f838e15643ed2fba35ef
SHA256

b36c42fd589f6eeacc8f5b4fb21b37c4eef8bd1a8a8a737d8e7e8d09f9f6e1dd
SHA512

0b7c5a97747333358cd41631c178f4810b54287e6516950f82e933e9909c3d66809d291985ed4d53b68920d9fba84bd9f7721b1ba80f96ce88668debf608df2b

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Targets

- Target
  
  f14a46d2d5535867d84aa11fa8ae5c2c
- Size
  
  10.2MB
- MD5
  
  f14a46d2d5535867d84aa11fa8ae5c2c
- SHA1
  
  39d19968f1106dae2917f838e15643ed2fba35ef
- SHA256
  
  b36c42fd589f6eeacc8f5b4fb21b37c4eef8bd1a8a8a737d8e7e8d09f9f6e1dd
- SHA512
  
  0b7c5a97747333358cd41631c178f4810b54287e6516950f82e933e9909c3d66809d291985ed4d53b68920d9fba84bd9f7721b1ba80f96ce88668debf608df2b
Score

10^/10

tofsee evasion persistence trojan
- Tofsee
  Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
  trojan tofsee
- Windows security bypass
  evasion trojan
- Creates new service(s)
  persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Sets service image path in registry
  persistence
- Deletes itself
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

New Service

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

tofseeevasionpersistencetrojan

behavioral2

tofseeevasionpersistencetrojan