tofsee | bbc6f4150ca247ebe2375c8c2041830d73a2c3c09df021f2c69c5ba16b4912b8 | Triage

Sharing

General

Target

f31cde8973df6ea521b90fdf8227374e_JaffaCakes118
Size

13.0MB
Sample

240416-kllskadf38
MD5

f31cde8973df6ea521b90fdf8227374e
SHA1

8bf7046fa636123c79e9e333f11c676364d038d0
SHA256

bbc6f4150ca247ebe2375c8c2041830d73a2c3c09df021f2c69c5ba16b4912b8
SHA512

1f20e1a8bc4914f9f774748b7d2d639506dc5d7ffdc288eb3c7f77aa8df2671c4c968dcf55f47556bee8dbe0e19c6785e538c813e7669ddd85733f82034b92e6
SSDEEP

12288:awyc+f7Y47sgQhihFAXE6iPzp666666666666666666666666666666666666662:aw+f7VQhBW

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.6

lazystax.ru

Targets

- Target
  
  f31cde8973df6ea521b90fdf8227374e_JaffaCakes118
- Size
  
  13.0MB
- MD5
  
  f31cde8973df6ea521b90fdf8227374e
- SHA1
  
  8bf7046fa636123c79e9e333f11c676364d038d0
- SHA256
  
  bbc6f4150ca247ebe2375c8c2041830d73a2c3c09df021f2c69c5ba16b4912b8
- SHA512
  
  1f20e1a8bc4914f9f774748b7d2d639506dc5d7ffdc288eb3c7f77aa8df2671c4c968dcf55f47556bee8dbe0e19c6785e538c813e7669ddd85733f82034b92e6
- SSDEEP
  
  12288:awyc+f7Y47sgQhihFAXE6iPzp666666666666666666666666666666666666662:aw+f7VQhBW
Score

10^/10

tofsee evasion persistence trojan
- Tofsee
  Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
  trojan tofsee
- Windows security bypass
  evasion trojan
- Creates new service(s)
  persistence
- Modifies Windows Firewall
  evasion
- Sets service image path in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tofseeevasionpersistencetrojan

behavioral2

tofseeevasionpersistencetrojan