Overview

overview

10

Static

static

3

cb1c506be2...d1.exe

windows7-x64

10

cb1c506be2...d1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e784b886059f077e303e48b572d98be151001e31fa09cef4264a083cd1822473

  • Size

    141KB

  • Sample

    240417-qt7b5ahg28

  • MD5

    960e4664daa29f117f471631d02621e2

  • SHA1

    cafd44899db37340da115edbfd10e2599a07605a

  • SHA256

    e784b886059f077e303e48b572d98be151001e31fa09cef4264a083cd1822473

  • SHA512

    ff573857ddfcc6e325e9eff2bfeee15773055d7f8da6fff59ebed855a7647bf2beef3ce790a5e52e31ba5a8647744cbc4e4d23ddcb4eff0090ded84bf3b08d7c

  • SSDEEP

    3072:nZyTwHnYSCvIv5xN1GKYlyplW8dsBsSAOTKxJV+kNlZZdFwpnXmDzW8Am:4UHYSCv2531GXlynBSwJgkvZZdFKn2J9

Score
10/10
tofseeevasionpersistencetrojan

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Targets

    • Target

      cb1c506be26eb65bd7c79abc7e54d356adea2c3e0993e605e98cc39611f7add1.exe

    • Size

      242KB

    • MD5

      f5d6e5056dea42913c3191340b0a4c0b

    • SHA1

      1d7138a2bbd768cd32a5fb1f69b2fc1f9a8c51ac

    • SHA256

      cb1c506be26eb65bd7c79abc7e54d356adea2c3e0993e605e98cc39611f7add1

    • SHA512

      44b7cf4fbed4b31f178a1e3bd6c444a637864292ad738fdd44e4b3eca7ce9f85b3ebe67b7119a3365c50a8e2d8913cfef142e9c8abe04e311b47a527dac401c5

    • SSDEEP

      3072:cqgKrfAukEDcJV8hGDRUwlqahBCXEKWd+7hTS6Ks48TR+TkFKu:fftDcGGDRblqahBkW2hTS78t+TkI

    Score
    10/10
    tofseeevasionpersistencetrojan

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

      trojantofsee

    • Windows security bypass

      evasiontrojan

    • Creates new service(s)

      persistence

    • Modifies Windows Firewall

      evasion

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks