Overview

overview

10

Static

static

123fc368db...93.exe

windows7_x64

10

123fc368db...93.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    123fc368dbf1ca4c0c4e02744b482619595c1243e79716979daeef9ba40db493

  • Size

    138KB

  • Sample

    220603-1w8m3sadcr

  • MD5

    0307b1309a9cba61448538348168bc63

  • SHA1

    1f434133f38bf2f91c28dbad9dba038cdbb8a63a

  • SHA256

    123fc368dbf1ca4c0c4e02744b482619595c1243e79716979daeef9ba40db493

  • SHA512

    eda4e15eb86832d6555d587e66d3f05327d239a03a73efaa15280b8ff77af6a17a09986bca3ddd3c08ba3db44581a865193691c69d07e46b409c8fd4c4205831

Score
10/10
tofseeevasionpersistencetrojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Targets

    • Target

      123fc368dbf1ca4c0c4e02744b482619595c1243e79716979daeef9ba40db493

    • Size

      138KB

    • MD5

      0307b1309a9cba61448538348168bc63

    • SHA1

      1f434133f38bf2f91c28dbad9dba038cdbb8a63a

    • SHA256

      123fc368dbf1ca4c0c4e02744b482619595c1243e79716979daeef9ba40db493

    • SHA512

      eda4e15eb86832d6555d587e66d3f05327d239a03a73efaa15280b8ff77af6a17a09986bca3ddd3c08ba3db44581a865193691c69d07e46b409c8fd4c4205831

    Score
    10/10
    tofseeevasionpersistencetrojan

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • Windows security bypass

      evasiontrojan

    • Creates new service(s)

      persistence

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks