General
Target

395523cf56f7bb9497764d72ed71bab457bc86cd338e46ee4efe470777c6670c

Size

142KB

Sample

220625-nepsesccd4

Score
10/10
MD5

fb665d4a9976f7a8d7d53b4ee8d3a3fd

SHA1

b2bcda3ea607a76f1f96d7b464bcec2950bc3da4

SHA256

395523cf56f7bb9497764d72ed71bab457bc86cd338e46ee4efe470777c6670c

SHA512

78bcc6ac3db476f1bb330c3bbf0fd18306d184c1b2ca189aa20bbd5dd0728a824f475141375ccb194aac76aefde1afc6dcfc0d34e348d8bc415f86dcf4f55ad7

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Targets
Target

395523cf56f7bb9497764d72ed71bab457bc86cd338e46ee4efe470777c6670c

MD5

fb665d4a9976f7a8d7d53b4ee8d3a3fd

Filesize

142KB

Score
10/10
SHA1

b2bcda3ea607a76f1f96d7b464bcec2950bc3da4

SHA256

395523cf56f7bb9497764d72ed71bab457bc86cd338e46ee4efe470777c6670c

SHA512

78bcc6ac3db476f1bb330c3bbf0fd18306d184c1b2ca189aa20bbd5dd0728a824f475141375ccb194aac76aefde1afc6dcfc0d34e348d8bc415f86dcf4f55ad7

Tags

Signatures

  • Tofsee

    Description

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    Tags

  • Creates new service(s)

    Tags

    TTPs

    New Service
  • Executes dropped EXE

  • Modifies Windows Firewall

    Tags

    TTPs

    Modify Existing Service
  • Sets service image path in registry

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry
  • Checks computer location settings

    Description

    Looks up country code configured in the registry, likely geofence.

    TTPs

    Query RegistrySystem Information Discovery
  • Loads dropped DLL

  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry
  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Tasks

                    static1

                    Score
                    N/A

                    behavioral1

                    Score
                    10/10

                    behavioral2

                    Score
                    10/10