a1f971dcd32057994be0c0ed4b0b787c056fe9cd7cf97a3f633ace7b87ddbd67

General
Target

a1f971dcd32057994be0c0ed4b0b787c056fe9cd7cf97a3f633ace7b87ddbd67

Size

296KB

Sample

211125-vang5afggl

Score
10 /10
MD5

757ce131ccde40f4dc3b83a4ff4cf139

SHA1

c752d3554b5cd4d55380afc651c39b4554f33e82

SHA256

a1f971dcd32057994be0c0ed4b0b787c056fe9cd7cf97a3f633ace7b87ddbd67

SHA512

93dc567d28527f4882a8acd548eeba6223b0ecf43f90a2580aca48d1fbc2828d922ad276899aa059d7046198f24e7d5334b9215bc8ac765f7da0155a78310a4a

Malware Config

Extracted

Family tofsee
C2

quadoil.ru

lakeflex.ru

Targets
Target

a1f971dcd32057994be0c0ed4b0b787c056fe9cd7cf97a3f633ace7b87ddbd67

MD5

757ce131ccde40f4dc3b83a4ff4cf139

Filesize

296KB

Score
10 /10
SHA1

c752d3554b5cd4d55380afc651c39b4554f33e82

SHA256

a1f971dcd32057994be0c0ed4b0b787c056fe9cd7cf97a3f633ace7b87ddbd67

SHA512

93dc567d28527f4882a8acd548eeba6223b0ecf43f90a2580aca48d1fbc2828d922ad276899aa059d7046198f24e7d5334b9215bc8ac765f7da0155a78310a4a

Tags

Signatures

  • Tofsee

    Description

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    Tags

  • Windows security bypass

    Tags

    TTPs

    Disabling Security Tools Modify Registry
  • xmrig

    Description

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    Tags

  • XMRig Miner Payload

    Tags

  • Creates new service(s)

    Tags

    TTPs

    New Service
  • Executes dropped EXE

  • Modifies Windows Firewall

    Tags

    TTPs

    Modify Existing Service
  • Sets service image path in registry

    Tags

    TTPs

    Registry Run Keys / Startup Folder Modify Registry
  • Deletes itself

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Tasks

                    static1