Overview

overview

10

Static

static

file.exe

windows7-x64

1

file.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    file

  • Size

    260KB

  • Sample

    221028-13mdeshch3

  • MD5

    3b3abb87e490934b2fa01fcaf6d4dc8e

  • SHA1

    e75882f88d8a04fb339f2700af6719820eeb86f6

  • SHA256

    89be1483f7f40e08b04db65dffe5d8bde05997c07febfe78fca863fd00d14966

  • SHA512

    748cf3dda03381a1575d263ac05cbb163c3442d0431c7fd958ea3b4de588c8b6b0cceec91400591626dad2168a4e36f0cc421bdba28da4ee9f512b81e85a6ab3

  • SSDEEP

    3072:F6H+BCRjL5EeY1z5ShLfC69DRQGIBFisPk64q4t8TbRM/h3:q+BujLieV3BIB5MZuh

Score
10/10
tofseepersistencetrojan

Malware Config

Targets

    • Target

      file

    • Size

      260KB

    • MD5

      3b3abb87e490934b2fa01fcaf6d4dc8e

    • SHA1

      e75882f88d8a04fb339f2700af6719820eeb86f6

    • SHA256

      89be1483f7f40e08b04db65dffe5d8bde05997c07febfe78fca863fd00d14966

    • SHA512

      748cf3dda03381a1575d263ac05cbb163c3442d0431c7fd958ea3b4de588c8b6b0cceec91400591626dad2168a4e36f0cc421bdba28da4ee9f512b81e85a6ab3

    • SSDEEP

      3072:F6H+BCRjL5EeY1z5ShLfC69DRQGIBFisPk64q4t8TbRM/h3:q+BujLieV3BIB5MZuh

    Score
    10/10
    tofseepersistencetrojan

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • Sets service image path in registry

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks