General

  • Target

    c331a5b18cf958df6f01d0008bdd32e3

  • Size

    10.7MB

  • Sample

    240312-m4rsmshb95

  • MD5

    c331a5b18cf958df6f01d0008bdd32e3

  • SHA1

    fa33822cb213509d117656ec02294810b7390f2e

  • SHA256

    0bc6c3a4165877f82c3337604713d8f2887d5ced1322a5dbe08d6599daa08969

  • SHA512

    c94a640ad18e14e2d4d06621d3971a6daccc814db56e1cc9cc3e4a631090959d7c71c8ad869ae5e82aac69d4d762eee80a9a32eae91c35a37a9b5e608c16feed

  • SSDEEP

    24576:vgdy5yNM4444444444444444444444444444444444444444444444444444444I:

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Targets

    • Target

      c331a5b18cf958df6f01d0008bdd32e3

    • Size

      10.7MB

    • MD5

      c331a5b18cf958df6f01d0008bdd32e3

    • SHA1

      fa33822cb213509d117656ec02294810b7390f2e

    • SHA256

      0bc6c3a4165877f82c3337604713d8f2887d5ced1322a5dbe08d6599daa08969

    • SHA512

      c94a640ad18e14e2d4d06621d3971a6daccc814db56e1cc9cc3e4a631090959d7c71c8ad869ae5e82aac69d4d762eee80a9a32eae91c35a37a9b5e608c16feed

    • SSDEEP

      24576:vgdy5yNM4444444444444444444444444444444444444444444444444444444I:

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks