Overview

overview

10

Static

static

3

42dff7201d...bd.exe

windows7-x64

10

42dff7201d...bd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    755dc3d00bddf9483a791e5ec4458f30.bin

  • Size

    149KB

  • Sample

    230517-blcefscc9x

  • MD5

    a17676eadc2eb80a392b0154aa13e947

  • SHA1

    ac8a0725f6ccab27a4d41c0dc84933bda0325c09

  • SHA256

    dd71266e04a5f32f95e788a166a0f38abdbe427c2c97ae95cf62acef130b38ed

  • SHA512

    f912b67d3715f9e47d8f57ce2885fcf8ef513c19319cc48d1d71cef4c9024f8f2e71654a34874d98ce401acfd930118ecfc3b130d31454f00c4de9a58c2fdf54

  • SSDEEP

    3072:5o75UbGcGYgHU5px8zoLRZAWqw6v1v77N+ZxS1u/urxkeW:qUbGQgHUqzCANBWZUG

Score
10/10
tofseexmrigevasionminerpersistencetrojan

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Targets

    • Target

      42dff7201d7e644ca0d8c5a4aa0c623fb2943b3d88f94794a2767a8aedfc30bd.exe

    • Size

      259KB

    • MD5

      755dc3d00bddf9483a791e5ec4458f30

    • SHA1

      0cb42a40bbfb57e68867e8b5f07e37f13ccd3ce3

    • SHA256

      42dff7201d7e644ca0d8c5a4aa0c623fb2943b3d88f94794a2767a8aedfc30bd

    • SHA512

      ce1e776753ba8d72cf18d5443ec4ca4d602dc531567d83f30cce817c0f5e8baa7955cdb22368b729a4b082ab79b4402a5cca5b7e0418770fc09662a3a82ab29d

    • SSDEEP

      3072:8Nu55AZAuEsBHOmuTmO7WeZH7+Ql/TWmoKbyBxUWmYEUP8nJ6nY/2TpzhC97MZ:NkC0BdnOye0w3oKba2t0nNdtY7MZ

    Score
    10/10
    tofseexmrigevasionminerpersistencetrojan

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • Windows security bypass

      evasiontrojan

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Creates new service(s)

      persistence

    • Modifies Windows Firewall

      evasion

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

1
T1050

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

New Service

1
T1050

Defense Evasion

Disabling Security Tools

1
T1089

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks