General

  • Target

    c3151ff8fcd5c1709d64c8456d919314

  • Size

    12.6MB

  • Sample

    240312-l2cehaeb7z

  • MD5

    c3151ff8fcd5c1709d64c8456d919314

  • SHA1

    0a05a0b3b40762602e903761adde873d9f70ef3a

  • SHA256

    dfb531e73f8f5ec6ebe2d60d38d5f9f897f79d3d07452f9e6e8bdf69e257f611

  • SHA512

    66e99c5a6c76c6eff31b450fa6ec082f570acd696c599af1066f4191984c2c552d598452bb6e5abe1466dc89640c35296796e50aebde88cabd3f0dcdadee8d1f

  • SSDEEP

    24576:thtJbmFQuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu:qF

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Targets

    • Target

      c3151ff8fcd5c1709d64c8456d919314

    • Size

      12.6MB

    • MD5

      c3151ff8fcd5c1709d64c8456d919314

    • SHA1

      0a05a0b3b40762602e903761adde873d9f70ef3a

    • SHA256

      dfb531e73f8f5ec6ebe2d60d38d5f9f897f79d3d07452f9e6e8bdf69e257f611

    • SHA512

      66e99c5a6c76c6eff31b450fa6ec082f570acd696c599af1066f4191984c2c552d598452bb6e5abe1466dc89640c35296796e50aebde88cabd3f0dcdadee8d1f

    • SSDEEP

      24576:thtJbmFQuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu:qF

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks