tofsee | 1cb4511945d33d1414e7edf75f28952256df660a4d70e5599d8d0c653a9c44fc | Triage

Sharing

General

Target

f27e816769871147e4862997714586f5_JaffaCakes118
Size

12.7MB
Sample

240416-c5akmshc7w
MD5

f27e816769871147e4862997714586f5
SHA1

6bc7cbca3c705c9da9890a8f4f5d22d273c1105a
SHA256

1cb4511945d33d1414e7edf75f28952256df660a4d70e5599d8d0c653a9c44fc
SHA512

710979b0bbb44401ae36b4f37d62257c5616317e6a9c66b797f10dc2b7e4f02e39a36cbd54134933c8bf6c528d79926041c66cd418d27b1ed60a9c4e35af364c
SSDEEP

24576:qTmCUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUg:9

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Targets

- Target
  
  f27e816769871147e4862997714586f5_JaffaCakes118
- Size
  
  12.7MB
- MD5
  
  f27e816769871147e4862997714586f5
- SHA1
  
  6bc7cbca3c705c9da9890a8f4f5d22d273c1105a
- SHA256
  
  1cb4511945d33d1414e7edf75f28952256df660a4d70e5599d8d0c653a9c44fc
- SHA512
  
  710979b0bbb44401ae36b4f37d62257c5616317e6a9c66b797f10dc2b7e4f02e39a36cbd54134933c8bf6c528d79926041c66cd418d27b1ed60a9c4e35af364c
- SSDEEP
  
  24576:qTmCUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUUg:9
Score

10^/10

tofsee evasion persistence trojan
- Tofsee
  Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
  trojan tofsee
- Windows security bypass
  evasion trojan
- Creates new service(s)
  persistence
- Modifies Windows Firewall
  evasion
- Sets service image path in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tofseeevasionpersistencetrojan

behavioral2

tofseeevasionpersistencetrojan