General

  • Target

    5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724

  • Size

    142KB

  • Sample

    220731-mtys7sdedm

  • MD5

    e4e980a178180b5aa5f096c10e9f5557

  • SHA1

    f55b0a91c0cc81e61d6f23b8695ce4fa917f04d6

  • SHA256

    5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724

  • SHA512

    5f762ee974d14b69deb25266835644a20862f2da14f64bde6885ff27e1250b840d6cf44f3f3b36742b1502692f879382ccc59c8cab08d56b299cd8c71a3f6109

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Targets

    • Target

      5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724

    • Size

      142KB

    • MD5

      e4e980a178180b5aa5f096c10e9f5557

    • SHA1

      f55b0a91c0cc81e61d6f23b8695ce4fa917f04d6

    • SHA256

      5f999ebf50703e544ffae3c27d30df4441a54f12360e7482135c02f58b95f724

    • SHA512

      5f762ee974d14b69deb25266835644a20862f2da14f64bde6885ff27e1250b840d6cf44f3f3b36742b1502692f879382ccc59c8cab08d56b299cd8c71a3f6109

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Creates new service(s)

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

New Service

1
T1050

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

New Service

1
T1050

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks