tofsee | 27a14e1653fb0b415ab18bd220930344f8423b18e5c1e6587b142d595035aa4c | Triage

Sharing

General

Target

27a14e1653fb0b415ab18bd220930344f8423b18e5c1e6587b142d595035aa4c
Size

281KB
Sample

220124-nxnyvaefak
MD5

85bfad50ecc780909d8add6568fb4fef
SHA1

5eaed9d25a9aeb34350bde97a8da7458ed2bcdc4
SHA256

27a14e1653fb0b415ab18bd220930344f8423b18e5c1e6587b142d595035aa4c
SHA512

f1186997d0af98e0cca86642f9d8cbf59f2e982a0b7f5e017f2cec654dd400abd85f21321fbc46c932bdb7f480f64745bf09b119b8459adec7ac5dfad9825b82

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

patmushta.info

ovicrush.cn

Targets

- Target
  
  27a14e1653fb0b415ab18bd220930344f8423b18e5c1e6587b142d595035aa4c
- Size
  
  281KB
- MD5
  
  85bfad50ecc780909d8add6568fb4fef
- SHA1
  
  5eaed9d25a9aeb34350bde97a8da7458ed2bcdc4
- SHA256
  
  27a14e1653fb0b415ab18bd220930344f8423b18e5c1e6587b142d595035aa4c
- SHA512
  
  f1186997d0af98e0cca86642f9d8cbf59f2e982a0b7f5e017f2cec654dd400abd85f21321fbc46c932bdb7f480f64745bf09b119b8459adec7ac5dfad9825b82
Score

10^/10

tofsee evasion persistence trojan
- Tofsee
  Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
  trojan tofsee
- Windows security bypass
  evasion trojan
- Creates new service(s)
  persistence
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Sets service image path in registry
  persistence
- Deletes itself
- Legitimate hosting services abused for malware hosting/C2
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

New Service

Defense Evasion

Disabling Security Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Tasks

static1

behavioral1

tofseeevasionpersistencetrojan