General

  • Target

    4585fb3371e05463f51493e049181ed6.exe

  • Size

    13.6MB

  • Sample

    240106-mccveaefh2

  • MD5

    4585fb3371e05463f51493e049181ed6

  • SHA1

    1d50b71e1238537c4deeff3825741771f2bb9165

  • SHA256

    5583cf616f524b652e3a55b0d5ae610b1326d04842873d5d202e762d8b541548

  • SHA512

    4ad2424a021e17bd4ac285d9e8e164d31d6604cb206cecd6d2cf5c905b3e63255fc9e182883d9d253abc428ab4ebddef25006d50a0986622dca13ef8cb0c6c1a

  • SSDEEP

    49152:FgMttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttr:F

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Targets

    • Target

      4585fb3371e05463f51493e049181ed6.exe

    • Size

      13.6MB

    • MD5

      4585fb3371e05463f51493e049181ed6

    • SHA1

      1d50b71e1238537c4deeff3825741771f2bb9165

    • SHA256

      5583cf616f524b652e3a55b0d5ae610b1326d04842873d5d202e762d8b541548

    • SHA512

      4ad2424a021e17bd4ac285d9e8e164d31d6604cb206cecd6d2cf5c905b3e63255fc9e182883d9d253abc428ab4ebddef25006d50a0986622dca13ef8cb0c6c1a

    • SSDEEP

      49152:FgMttttttttttttttttttttttttttttttttttttttttttttttttttttttttttttr:F

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Creates new service(s)

    • Modifies Windows Firewall

MITRE ATT&CK Enterprise v15

Tasks