General

  • Target

    c3c85ddc2a0234163f75b40b2c04f98b

  • Size

    10.4MB

  • Sample

    240312-tltb3sdb91

  • MD5

    c3c85ddc2a0234163f75b40b2c04f98b

  • SHA1

    1b49c1c09ebcfc281dc47ce1097cf9adf59bc19c

  • SHA256

    4280100bfda8c40dfa99c5dd6109e63e8710185a432e795893711c5dca116838

  • SHA512

    2e00d8ddb566b842e653280701ac70189e041322f1fca6044bdafecb2b0ea63e8f2f62080e229073df21640a732af281966c5a6c2a923adad554ab0c90bd1c45

  • SSDEEP

    12288:zBgw6aInPRfmCzFT+PUvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvn:qw6tHRT+P

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Targets

    • Target

      c3c85ddc2a0234163f75b40b2c04f98b

    • Size

      10.4MB

    • MD5

      c3c85ddc2a0234163f75b40b2c04f98b

    • SHA1

      1b49c1c09ebcfc281dc47ce1097cf9adf59bc19c

    • SHA256

      4280100bfda8c40dfa99c5dd6109e63e8710185a432e795893711c5dca116838

    • SHA512

      2e00d8ddb566b842e653280701ac70189e041322f1fca6044bdafecb2b0ea63e8f2f62080e229073df21640a732af281966c5a6c2a923adad554ab0c90bd1c45

    • SSDEEP

      12288:zBgw6aInPRfmCzFT+PUvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvn:qw6tHRT+P

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks