General

  • Target

    c37c564def01d679224ccbf18982fccf

  • Size

    12.4MB

  • Sample

    240312-qq5zwshh2z

  • MD5

    c37c564def01d679224ccbf18982fccf

  • SHA1

    ed41337991eb418f5452f3c98150971ad95e9cc0

  • SHA256

    dc785503478a6eb99a6178234c85a2bf98f396032152873f5a246c364fa78e02

  • SHA512

    0fbf93933b3b3941a2a082caf70a36516402be85e3911cebc79402728bead62503b72040f866e6330f01f8d338fd349a8e2714a9c95b4bc4f63e6a5ff494ed8b

  • SSDEEP

    49152:Djrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr7:P

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Targets

    • Target

      c37c564def01d679224ccbf18982fccf

    • Size

      12.4MB

    • MD5

      c37c564def01d679224ccbf18982fccf

    • SHA1

      ed41337991eb418f5452f3c98150971ad95e9cc0

    • SHA256

      dc785503478a6eb99a6178234c85a2bf98f396032152873f5a246c364fa78e02

    • SHA512

      0fbf93933b3b3941a2a082caf70a36516402be85e3911cebc79402728bead62503b72040f866e6330f01f8d338fd349a8e2714a9c95b4bc4f63e6a5ff494ed8b

    • SSDEEP

      49152:Djrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr7:P

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks