General

  • Target

    c635f41ebf3ca65e08d1362059979048

  • Size

    14.9MB

  • Sample

    240313-srj5xsac45

  • MD5

    c635f41ebf3ca65e08d1362059979048

  • SHA1

    640c47631156f6496dc7df0f308cc7eee70f821e

  • SHA256

    ee05048c2821eb7ac4e81d4a1ea0ee9b75ac1c33d476a9fa488bbe28619a47f3

  • SHA512

    4ff0d29b1fd393499a5fbb5977726697db83d6aad12e063ad71fa44f20852bc4a88c756ef965f788ebf82d1551d4a3595bfe99eb76e3040bb524d6f07e574831

  • SSDEEP

    393216:Euuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuur:

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Targets

    • Target

      c635f41ebf3ca65e08d1362059979048

    • Size

      14.9MB

    • MD5

      c635f41ebf3ca65e08d1362059979048

    • SHA1

      640c47631156f6496dc7df0f308cc7eee70f821e

    • SHA256

      ee05048c2821eb7ac4e81d4a1ea0ee9b75ac1c33d476a9fa488bbe28619a47f3

    • SHA512

      4ff0d29b1fd393499a5fbb5977726697db83d6aad12e063ad71fa44f20852bc4a88c756ef965f788ebf82d1551d4a3595bfe99eb76e3040bb524d6f07e574831

    • SSDEEP

      393216:Euuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuur:

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks