Overview

overview

10

Static

static

1

77b5c60d25...eb.exe

windows7-x64

10

77b5c60d25...eb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    77b5c60d25ee308a2c29e9363e105bfc42b3f0c6eb92285b620454f9c952d1eb.zip

  • Size

    161KB

  • Sample

    230414-zmgybsdc8w

  • MD5

    1e00f1b4b5877ed66c796b6c8ad2ef60

  • SHA1

    fd9bcb1f87d5be47b727dedb05bacce62dcdfb08

  • SHA256

    7cfc0cb1634d36afcbb33d202d956c030d5d0cc15113eb7c64d3429c50fb1a22

  • SHA512

    58d18042db0c4ae3762dde5b9567769f6fa71224b057559ce9e7d9e185dbf71f4afcd8fb1a0f6a1414de1352fee41ec4d3aa926fa569387b78216d3f897bf457

  • SSDEEP

    3072:TCWPaDD4ksk4XVfj5Qdh/0tVO/U1nPpOLTVksbsjnzvTTKijqx6LEUIN7auA:eNDELXVfj5Qd+GU1nxOLrAzD6ijVEUe0

Score
10/10
tofseeevasionpersistencetrojan

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Targets

    • Target

      77b5c60d25ee308a2c29e9363e105bfc42b3f0c6eb92285b620454f9c952d1eb.exe

    • Size

      276KB

    • MD5

      80ee506064ae22c8ea34ffb2431f2488

    • SHA1

      0c5a71beb97751a781203d598e97e5a746df62df

    • SHA256

      77b5c60d25ee308a2c29e9363e105bfc42b3f0c6eb92285b620454f9c952d1eb

    • SHA512

      39be470cc5e8f170296371c7cfb7727b402e4c8b6e1ea6d66fe4195aa83f090cb9cf17d941dbb15214ae9e0a20f0015a190eb35a563067f2d645ea3f21609a6c

    • SSDEEP

      3072:/3czQeDsw9vCdirSqJ4GGueYDDwOtDUeblv8zMrnwg5o6JP3WJ0nWFok:GQmstdiDJ4xuHDwiDpd8z+w56J+Dak

    Score
    10/10
    tofseeevasionpersistencetrojan

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • Windows security bypass

      evasiontrojan

    • Creates new service(s)

      persistence

    • Modifies Windows Firewall

      evasion

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks