Description
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
General
Target
Size
Sample
39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9
312KB
220625-jg1v9abeem
Score
10/10
MD5
SHA1
SHA256
SHA512
469c2f23c85976e2d7a79c013b87121b
a98f1b95299a2546aca7e959b9af97eed341a01b
39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9
1ef5fdeb5f0fd3872d351c93c661fdebc504cec452ff9e00ab3abc7a84aea0be9ba3d2de52e7c3c900b67b55d95c2422d0cdc2ed16ada940a4f662ac884559c9
Malware Config
Extracted
| Family | tofsee |
| C2 |
43.231.4.7 lazystax.ru |
Targets
Target
MD5
Filesize
39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9
469c2f23c85976e2d7a79c013b87121b
312KB
Score
10/10
SHA1
SHA256
SHA512
a98f1b95299a2546aca7e959b9af97eed341a01b
39e2b92059aea92f0cef66384347db789668df9ba87067a21060b6fdf7da7bc9
1ef5fdeb5f0fd3872d351c93c661fdebc504cec452ff9e00ab3abc7a84aea0be9ba3d2de52e7c3c900b67b55d95c2422d0cdc2ed16ada940a4f662ac884559c9
Tags
Signatures
-
Tofsee
-
Windows security bypass
Tags
TTPs
-
Creates new service(s)
Tags
TTPs
-
Executes dropped EXE
-
Modifies Windows Firewall
Tags
TTPs
-
Sets service image path in registry
Tags
TTPs
-
Checks computer location settings
Description
Looks up country code configured in the registry, likely geofence.
TTPs
-
Deletes itself
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Privilege Escalation
Tasks
static1
Score
N/A
behavioral1
Score
10/10
behavioral2
Score
10/10