General

  • Target

    c70fa28f653d752fc06ad0df1822a188

  • Size

    11.8MB

  • Sample

    240313-2yg4ksdg98

  • MD5

    c70fa28f653d752fc06ad0df1822a188

  • SHA1

    1a772deb64508b4e636ba6cddcd946084e2949f3

  • SHA256

    f79e69363bcac362a64e06a1737ef4499e890a9c113a63b6702a850bd3a9d66f

  • SHA512

    daf3e9f67957e7be4b775bf7c03da6a003d7e97ee6c6fa3fe1138d76e8c27da7785a22a544c8cf045662f576759a53a73b3247cf2dcee0824e50301d27054a58

  • SSDEEP

    6144:W5VCb4QuzFZpIozzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz7:A8NKFZp

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Targets

    • Target

      c70fa28f653d752fc06ad0df1822a188

    • Size

      11.8MB

    • MD5

      c70fa28f653d752fc06ad0df1822a188

    • SHA1

      1a772deb64508b4e636ba6cddcd946084e2949f3

    • SHA256

      f79e69363bcac362a64e06a1737ef4499e890a9c113a63b6702a850bd3a9d66f

    • SHA512

      daf3e9f67957e7be4b775bf7c03da6a003d7e97ee6c6fa3fe1138d76e8c27da7785a22a544c8cf045662f576759a53a73b3247cf2dcee0824e50301d27054a58

    • SSDEEP

      6144:W5VCb4QuzFZpIozzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz7:A8NKFZp

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks