General

  • Target

    c4715c184ff24bb57a0bebd754befee8

  • Size

    11.0MB

  • Sample

    240313-aahxeseg9t

  • MD5

    c4715c184ff24bb57a0bebd754befee8

  • SHA1

    ec4771644edb8e17b0894840851495d74daace8d

  • SHA256

    e3097c342d342a0e898bece7e70795a908ef44702d9ebc5dd9a1bc2af0c32f35

  • SHA512

    85847ce43c5a77b6545b09046298567f974296da4b87bd9a6fceafa2edd64db4c3c45a9e42b30770b1974c3faf1536669484c06daf8166e38e5d75f9fa4baaf6

  • SSDEEP

    49152:kwFPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPn:z

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Targets

    • Target

      c4715c184ff24bb57a0bebd754befee8

    • Size

      11.0MB

    • MD5

      c4715c184ff24bb57a0bebd754befee8

    • SHA1

      ec4771644edb8e17b0894840851495d74daace8d

    • SHA256

      e3097c342d342a0e898bece7e70795a908ef44702d9ebc5dd9a1bc2af0c32f35

    • SHA512

      85847ce43c5a77b6545b09046298567f974296da4b87bd9a6fceafa2edd64db4c3c45a9e42b30770b1974c3faf1536669484c06daf8166e38e5d75f9fa4baaf6

    • SSDEEP

      49152:kwFPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPn:z

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks