General
Target

39925d256ffb487c669d5c3bb768eba1f9cfa7595c7faf0947c9bcd52c2cf1c9

Size

258KB

Sample

220625-ln4ltsfbdq

Score
10/10
MD5

7a717003f647ffa187853202db3cbe44

SHA1

10b25fb91c1e200aba57b13ca96996a3a62dc77f

SHA256

39925d256ffb487c669d5c3bb768eba1f9cfa7595c7faf0947c9bcd52c2cf1c9

SHA512

0c97a36671dd383481f665d910038404aa83b9e37cfcd127a08a7a57865b04450f19dc3a987d04b4e01aeed54835d126325042655e0116dfe12f687dd40b0577

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Targets
Target

39925d256ffb487c669d5c3bb768eba1f9cfa7595c7faf0947c9bcd52c2cf1c9

MD5

7a717003f647ffa187853202db3cbe44

Filesize

258KB

Score
10/10
SHA1

10b25fb91c1e200aba57b13ca96996a3a62dc77f

SHA256

39925d256ffb487c669d5c3bb768eba1f9cfa7595c7faf0947c9bcd52c2cf1c9

SHA512

0c97a36671dd383481f665d910038404aa83b9e37cfcd127a08a7a57865b04450f19dc3a987d04b4e01aeed54835d126325042655e0116dfe12f687dd40b0577

Tags

Signatures

  • Tofsee

    Description

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    Tags

  • Windows security bypass

    Tags

    TTPs

    Disabling Security ToolsModify Registry
  • Creates new service(s)

    Tags

    TTPs

    New Service
  • Executes dropped EXE

  • Modifies Windows Firewall

    Tags

    TTPs

    Modify Existing Service
  • Sets service image path in registry

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry
  • Checks computer location settings

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery
  • Deletes itself

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Tasks

                    static1

                    Score
                    N/A

                    behavioral1

                    Score
                    10/10

                    behavioral2

                    Score
                    10/10