Overview

overview

10

Static

static

c768addec0...4c.exe

windows7-x64

10

c768addec0...4c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c

  • Size

    189KB

  • Sample

    221203-bjc8zaeg8x

  • MD5

    eeb7e6c7f4ab9c7830b11f7fd7fd2011

  • SHA1

    beb0384bd419447ab753de454e8d071923928e98

  • SHA256

    c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c

  • SHA512

    ed7c18c625baa2aa36987dc23ecb56434d473e8fe060b6cecd2e3f043a923fa0cece81e442471271ec9d282042b0dd1cd0dd6abd7ca70aa01b6afe5186fae208

  • SSDEEP

    3072:w7F7r/UFftCzKka2Y2dMOSbSl8+pOW3jfSgDdB:88F2BdbjbbjzDf

Score
10/10
tofseepersistencetrojan

Malware Config

Extracted

Family

tofsee

C2

91.121.4.118

rgtryhbgddtyh.biz

wertdghbyrukl.ch

Targets

    • Target

      c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c

    • Size

      189KB

    • MD5

      eeb7e6c7f4ab9c7830b11f7fd7fd2011

    • SHA1

      beb0384bd419447ab753de454e8d071923928e98

    • SHA256

      c768addec07d2c59e940ab729f09c9e3c346bb7cd633a5ab351eb5bda695714c

    • SHA512

      ed7c18c625baa2aa36987dc23ecb56434d473e8fe060b6cecd2e3f043a923fa0cece81e442471271ec9d282042b0dd1cd0dd6abd7ca70aa01b6afe5186fae208

    • SSDEEP

      3072:w7F7r/UFftCzKka2Y2dMOSbSl8+pOW3jfSgDdB:88F2BdbjbbjzDf

    Score
    10/10
    tofseepersistencetrojan

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks