Description
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
General
Target
Size
Sample
e589ca07439b86d88a5820b00535a1fac141bd022c904fff4b80c914d5d67862
313KB
220620-qs46dafga9
Score
10/10
MD5
SHA1
SHA256
SHA512
8567240f275baaeb316c12f0cab580a6
d2f07a8889c0e038d3b95dc434faa36b93114698
e589ca07439b86d88a5820b00535a1fac141bd022c904fff4b80c914d5d67862
b7daf73bb899dc5b27a0face5f6b02d918b13052e9b1e104243681e85023198adcfccca090a9ba77cf3d966ccb84f0b70400af4f1bd4474b9b126f39a00f0406
Malware Config
Extracted
| Family | tofsee |
| C2 |
svartalfheim.top jotunheim.name |
Targets
Target
MD5
Filesize
e589ca07439b86d88a5820b00535a1fac141bd022c904fff4b80c914d5d67862
8567240f275baaeb316c12f0cab580a6
313KB
Score
10/10
SHA1
SHA256
SHA512
d2f07a8889c0e038d3b95dc434faa36b93114698
e589ca07439b86d88a5820b00535a1fac141bd022c904fff4b80c914d5d67862
b7daf73bb899dc5b27a0face5f6b02d918b13052e9b1e104243681e85023198adcfccca090a9ba77cf3d966ccb84f0b70400af4f1bd4474b9b126f39a00f0406
Tags
Signatures
-
Tofsee
-
xmrig
Description
XMRig is a high performance, open source, cross platform CPU/GPU miner.
Tags
-
XMRig Miner Payload
Tags
-
Creates new service(s)
Tags
TTPs
-
Executes dropped EXE
-
Modifies Windows Firewall
Tags
TTPs
-
Sets service image path in registry
Tags
TTPs
-
Checks computer location settings
Description
Looks up country code configured in the registry, likely geofence.
TTPs
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Privilege Escalation
Tasks
static1
Score
N/A
behavioral1
Score
10/10