General

  • Target

    c637fdee9deae84802b7dcabb277356d

  • Size

    14.9MB

  • Sample

    240313-svbb7aad33

  • MD5

    c637fdee9deae84802b7dcabb277356d

  • SHA1

    b53586c7d4dea58c92f0b8e534038f5247c9bc82

  • SHA256

    385af513502f03fe2fee0d4c512d69b80e222e0b4d5afee1d54f4058efb71419

  • SHA512

    5bff3eb4f02a346ae32ed29e638c42e8b22318b3bbd6045ca7ea34a70eadf51f69c9876e074c20fb2938e44e68f4525f5bfb11acc4f5679ac1796465297054b7

  • SSDEEP

    98304:ObbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbD:

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Targets

    • Target

      c637fdee9deae84802b7dcabb277356d

    • Size

      14.9MB

    • MD5

      c637fdee9deae84802b7dcabb277356d

    • SHA1

      b53586c7d4dea58c92f0b8e534038f5247c9bc82

    • SHA256

      385af513502f03fe2fee0d4c512d69b80e222e0b4d5afee1d54f4058efb71419

    • SHA512

      5bff3eb4f02a346ae32ed29e638c42e8b22318b3bbd6045ca7ea34a70eadf51f69c9876e074c20fb2938e44e68f4525f5bfb11acc4f5679ac1796465297054b7

    • SSDEEP

      98304:ObbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbD:

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks