tofsee | 2d509bcf0f3bdffd0b8490e8736079b141a012e9a33c669b99143145053b413e | Triage

Sharing

General

Target

2d509bcf0f3bdffd0b8490e8736079b141a012e9a33c669b99143145053b413e
Size

193KB
Sample

240417-rvrhqsca82
MD5

9a1230c93685755117dd972c638772ad
SHA1

664d7f5191cec123497820866d36b6d4c0f60baa
SHA256

2d509bcf0f3bdffd0b8490e8736079b141a012e9a33c669b99143145053b413e
SHA512

0d679cfcea1078aea974aa60edbd7731ed5282fe664378f94938ae85cbf5c0f2088ffc8d4309a647fa7303fa4664b09243d86f0a5f37bf82f3d0c717e64f0fcd
SSDEEP

3072:u6C5/bh1tsdt/Zd3IpQpP8VVeKAZiVTtw3pDK+9l3mMVvbJJpHrXcMfAXs42PG31:3C5/b+t//3ZpPIxA0VcpWglfLF8aHQ

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Targets

- Target
  
  8e94ab9df264de254c2961478a718dd9e960b8701a4aa75015fde99d1f1020b1.exe
- Size
  
  331KB
- MD5
  
  3424a650d03640ec89fbb499d6674480
- SHA1
  
  1ea36d7a77ec67039e67f944280dfdcdf1582991
- SHA256
  
  8e94ab9df264de254c2961478a718dd9e960b8701a4aa75015fde99d1f1020b1
- SHA512
  
  5f8bed9cf3da89216af3b87d580535a29a67a617b8bee82e448ae2d02f4cf38975058d2a0d02cf3d48411745a8fc19d09eb5936b66d7be1c75d31087142e2411
- SSDEEP
  
  6144:/K6gQvvYlQo7wU9TZlSmHgafhoeyz5xYmX/M:C5QvvYlhbCmHgGhoeYxYmE
Score

10^/10

tofsee evasion persistence trojan
- Tofsee
  Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
  trojan tofsee
- Windows security bypass
  evasion trojan
- Creates new service(s)
  persistence
- Modifies Windows Firewall
  evasion
- Sets service image path in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tofseeevasionpersistencetrojan

behavioral2

tofseeevasionpersistencetrojan