General

  • Target

    e19fbdc90f922c54a045d137336d702f

  • Size

    13.4MB

  • Sample

    240327-n8ngfsbf45

  • MD5

    e19fbdc90f922c54a045d137336d702f

  • SHA1

    7490929f5de915568ea036a7edee8740e38f1c32

  • SHA256

    2884a53e3ce2baf57ae5bbdc7fa1a5130e6932bd7b1c79576cf7131107e4fe06

  • SHA512

    5559252288953f7e663e18f8746298915c6f033dcf42538ada77dc9ae42cc4930249740bd888f17ad7e87b9faa3ff3d71d9478193195a83203bff4935e3df531

  • SSDEEP

    49152:s88888888888888888888888888888888888888888888888888888888888888:

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Targets

    • Target

      e19fbdc90f922c54a045d137336d702f

    • Size

      13.4MB

    • MD5

      e19fbdc90f922c54a045d137336d702f

    • SHA1

      7490929f5de915568ea036a7edee8740e38f1c32

    • SHA256

      2884a53e3ce2baf57ae5bbdc7fa1a5130e6932bd7b1c79576cf7131107e4fe06

    • SHA512

      5559252288953f7e663e18f8746298915c6f033dcf42538ada77dc9ae42cc4930249740bd888f17ad7e87b9faa3ff3d71d9478193195a83203bff4935e3df531

    • SSDEEP

      49152:s88888888888888888888888888888888888888888888888888888888888888:

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks