tofsee

General

Target

33625a61049adc1d32e7478e65781d1d35909d033b6410f87727fc533bbb5ed8
Size

265KB
Sample

220605-qs14qaaga6
MD5

7e1a83a5cb0b0534588cf783c0b3dd4e
SHA1

9ded7ea8e1b71605ca83ef1e1083d9ec703d2dde
SHA256

33625a61049adc1d32e7478e65781d1d35909d033b6410f87727fc533bbb5ed8
SHA512

775c3f81d9494fddcce0ddd45ad6e62deed6dc6c03fd5ed0ab3f19603f813d0f8a99c290d69ae2abb80115e88775c4cb5c45912ed0e954033b5a4e912ae591d2

Score

10^/10

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Targets

- Target
  
  33625a61049adc1d32e7478e65781d1d35909d033b6410f87727fc533bbb5ed8
- Size
  
  265KB
- MD5
  
  7e1a83a5cb0b0534588cf783c0b3dd4e
- SHA1
  
  9ded7ea8e1b71605ca83ef1e1083d9ec703d2dde
- SHA256
  
  33625a61049adc1d32e7478e65781d1d35909d033b6410f87727fc533bbb5ed8
- SHA512
  
  775c3f81d9494fddcce0ddd45ad6e62deed6dc6c03fd5ed0ab3f19603f813d0f8a99c290d69ae2abb80115e88775c4cb5c45912ed0e954033b5a4e912ae591d2
Score

10^/10

tofsee xmrig discovery evasion miner persistence spyware stealer trojan
- Tofsee
  Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
  trojan tofsee
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner Payload
  miner
- Creates new service(s)
  persistence
- Downloads MZ/PE file
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Sets service image path in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1