General

  • Target

    dcc74fee54b211fbb1fe169670a9d584

  • Size

    13.8MB

  • Sample

    240325-amwn2sdg2x

  • MD5

    dcc74fee54b211fbb1fe169670a9d584

  • SHA1

    697c698598f8be403095672a81c7aa38fc28dbe5

  • SHA256

    bda82890c5683f40781a97dfcf01d2fb46829382d6edb7e7643fb48a72ebe886

  • SHA512

    10c925815513b244e21a182637146181a5f8dbf288ce7e282509345eb056cd7dfd7cfd525d2eb61ae8f088abea10d181a92f32ae3592c83cce4819923ff46a40

  • SSDEEP

    24576:Pgdy5yNM4444444444444444444444444444444444444444444444444444444c:

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Targets

    • Target

      dcc74fee54b211fbb1fe169670a9d584

    • Size

      13.8MB

    • MD5

      dcc74fee54b211fbb1fe169670a9d584

    • SHA1

      697c698598f8be403095672a81c7aa38fc28dbe5

    • SHA256

      bda82890c5683f40781a97dfcf01d2fb46829382d6edb7e7643fb48a72ebe886

    • SHA512

      10c925815513b244e21a182637146181a5f8dbf288ce7e282509345eb056cd7dfd7cfd525d2eb61ae8f088abea10d181a92f32ae3592c83cce4819923ff46a40

    • SSDEEP

      24576:Pgdy5yNM4444444444444444444444444444444444444444444444444444444c:

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks