General

  • Target

    f08ef976399d689606476d66c27fd296_JaffaCakes118

  • Size

    10.7MB

  • Sample

    240415-h396dabg8y

  • MD5

    f08ef976399d689606476d66c27fd296

  • SHA1

    9548ee96f3d97088337aec3d64ed5bf790142372

  • SHA256

    3364d59b3931e56bb8cbc6163b0731d9395098bba4c3f3c016fc22cbfc2a75c7

  • SHA512

    16ac68b7c21bd35091b90e5ed88de904c0c0373b8e2e8255cf366e954f0ec22b90abc0fae975ccb46e9a918e8472c9fd40f984e090f3bde58e38b19bd93c2562

  • SSDEEP

    49152:U1yvllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll:UA

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Targets

    • Target

      f08ef976399d689606476d66c27fd296_JaffaCakes118

    • Size

      10.7MB

    • MD5

      f08ef976399d689606476d66c27fd296

    • SHA1

      9548ee96f3d97088337aec3d64ed5bf790142372

    • SHA256

      3364d59b3931e56bb8cbc6163b0731d9395098bba4c3f3c016fc22cbfc2a75c7

    • SHA512

      16ac68b7c21bd35091b90e5ed88de904c0c0373b8e2e8255cf366e954f0ec22b90abc0fae975ccb46e9a918e8472c9fd40f984e090f3bde58e38b19bd93c2562

    • SSDEEP

      49152:U1yvllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll:UA

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks