General

  • Target

    file.exe

  • Size

    255KB

  • Sample

    231106-qgm3qabc7x

  • MD5

    86f2d42c31de6b4ed2cd10e557c9673d

  • SHA1

    42946e4ae31b9b8f0d24d8ad93650563a57815f3

  • SHA256

    896f52874ec498aba7912b3c0d313c576062349eae34916f107944672b6c3e65

  • SHA512

    0723caa684a2fdb027cb0172aa38c0e7a63d108f82dbea08a23c5c55875c46fc1e970ca648ce5cbe6a353421e83bb6c784b49b0d6456f9e309bdf0dc6077fcfe

  • SSDEEP

    3072:67A57N1mxrhd03ZHFkQa+uPia8WjAu1gWk2ffQvER5QX1zzm75Oa0ZLekoGOUZ:601mxldw2Qa+u9g6ffQcR5QtmF0ZKko

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Targets

    • Target

      file.exe

    • Size

      255KB

    • MD5

      86f2d42c31de6b4ed2cd10e557c9673d

    • SHA1

      42946e4ae31b9b8f0d24d8ad93650563a57815f3

    • SHA256

      896f52874ec498aba7912b3c0d313c576062349eae34916f107944672b6c3e65

    • SHA512

      0723caa684a2fdb027cb0172aa38c0e7a63d108f82dbea08a23c5c55875c46fc1e970ca648ce5cbe6a353421e83bb6c784b49b0d6456f9e309bdf0dc6077fcfe

    • SSDEEP

      3072:67A57N1mxrhd03ZHFkQa+uPia8WjAu1gWk2ffQvER5QX1zzm75Oa0ZLekoGOUZ:601mxldw2Qa+u9g6ffQcR5QtmF0ZKko

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Windows security bypass

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks