Overview

overview

10

Static

static

3

f17afb5f20...18.exe

windows7-x64

10

f17afb5f20...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f17afb5f20aa53a7c7ffdb7f03fde7fc_JaffaCakes118

  • Size

    12.1MB

  • Sample

    240415-tvqybada9s

  • MD5

    f17afb5f20aa53a7c7ffdb7f03fde7fc

  • SHA1

    7cdf905690e6c242fda8d6a4882294c65c6f649c

  • SHA256

    a8cc9358a6bb7013fdc8abf9a1371c7b22a3b7311eec92dae140c844463d95bd

  • SHA512

    266dd4974d978144e8045b292bff3f61ee268105c2c92919ec4cc60358e42a1f40fb4c5bb3307accf1c2decbe935fddaf912c92492868ea5603384b4cc2db712

  • SSDEEP

    24576:+jDuKnh7YzbKBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBn:+nh

Score
10/10
tofseeevasionpersistencetrojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Targets

    • Target

      f17afb5f20aa53a7c7ffdb7f03fde7fc_JaffaCakes118

    • Size

      12.1MB

    • MD5

      f17afb5f20aa53a7c7ffdb7f03fde7fc

    • SHA1

      7cdf905690e6c242fda8d6a4882294c65c6f649c

    • SHA256

      a8cc9358a6bb7013fdc8abf9a1371c7b22a3b7311eec92dae140c844463d95bd

    • SHA512

      266dd4974d978144e8045b292bff3f61ee268105c2c92919ec4cc60358e42a1f40fb4c5bb3307accf1c2decbe935fddaf912c92492868ea5603384b4cc2db712

    • SSDEEP

      24576:+jDuKnh7YzbKBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBn:+nh

    Score
    10/10
    tofseeevasionpersistencetrojan

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • Windows security bypass

      evasiontrojan

    • Creates new service(s)

      persistence

    • Modifies Windows Firewall

      evasion

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks