General

  • Target

    dc8a67dcd59bc102ffe22259cf4b1481

  • Size

    10.6MB

  • Sample

    240321-y8lmzabc2s

  • MD5

    dc8a67dcd59bc102ffe22259cf4b1481

  • SHA1

    8369b42482690b370b2704d2ddcd90907d520e05

  • SHA256

    1c2598795dd3289f7ea13293c33b4df5d89adbd9f6d9a8f2f3072b389dca20c7

  • SHA512

    de6e6f6a0c18040488d985e6ab8edbbdc162348932f7a71996dfa431faa3cdb23e744c4b6d60487c00cc29eab4c620c7d03f444799b6b4655e2599e552163a2e

  • SSDEEP

    98304:d2UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUH:d

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Targets

    • Target

      dc8a67dcd59bc102ffe22259cf4b1481

    • Size

      10.6MB

    • MD5

      dc8a67dcd59bc102ffe22259cf4b1481

    • SHA1

      8369b42482690b370b2704d2ddcd90907d520e05

    • SHA256

      1c2598795dd3289f7ea13293c33b4df5d89adbd9f6d9a8f2f3072b389dca20c7

    • SHA512

      de6e6f6a0c18040488d985e6ab8edbbdc162348932f7a71996dfa431faa3cdb23e744c4b6d60487c00cc29eab4c620c7d03f444799b6b4655e2599e552163a2e

    • SSDEEP

      98304:d2UUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUH:d

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks