Description
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
General
Target
Size
Sample
3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc
262KB
220701-bylhwsgca6
Score
10/10
MD5
SHA1
SHA256
SHA512
f0a0aad635dfaf849e931d305893f282
1501b1f501b1ba2d3b42555f8292e32bd9c00268
3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc
26f7773e81fdd30fd86cac6b6ded11333f1f95cc1a7d8301d535a1ead16cda38368c96a5fee0fa927197118458a57b442ddf446ce7fe0f1531f3c3b50e2ac96f
Malware Config
Extracted
| Family | tofsee |
| C2 |
43.231.4.7 lazystax.ru |
Targets
Target
MD5
Filesize
3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc
f0a0aad635dfaf849e931d305893f282
262KB
Score
10/10
SHA1
SHA256
SHA512
1501b1f501b1ba2d3b42555f8292e32bd9c00268
3f73b53edc186f0fccb07ac7c9bbffb5b22e8625585388661fd7ee4836d84ccc
26f7773e81fdd30fd86cac6b6ded11333f1f95cc1a7d8301d535a1ead16cda38368c96a5fee0fa927197118458a57b442ddf446ce7fe0f1531f3c3b50e2ac96f
Tags
Signatures
-
Tofsee
-
Windows security bypass
Tags
TTPs
-
Creates new service(s)
Tags
TTPs
-
Executes dropped EXE
-
Modifies Windows Firewall
Tags
TTPs
-
Sets service image path in registry
Tags
TTPs
-
Checks computer location settings
Description
Looks up country code configured in the registry, likely geofence.
TTPs
-
Deletes itself
-
Suspicious use of SetThreadContext
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Privilege Escalation
Tasks
static1
Score
N/A
behavioral1
Score
10/10
behavioral2
Score
10/10