tofsee | d6f43f31fce6ae40ebfad16c8c01d765a965a2aae9907ffcaefe293031356a75 | Triage

Sharing

General

Target

f8518c38784e9b78cae4bc2b90bfc289_JaffaCakes118
Size

14.7MB
Sample

240418-tkcb6shc69
MD5

f8518c38784e9b78cae4bc2b90bfc289
SHA1

1a58456029f8a0af14172b797150241a2565b8b9
SHA256

d6f43f31fce6ae40ebfad16c8c01d765a965a2aae9907ffcaefe293031356a75
SHA512

53489166d21faceae92bd7a48995b0fb03009b3b50cfaf05f0e03c78c372db2e810167fd406ab8cc1456e6874418bebb5b94e16450c61b86120e887a2cff3b44
SSDEEP

12288:khq8okPz+6/uWlQJVppppppppppppppppppppppppppppppppppppppppppppppB:dSz+R

Score

10^/10

tofsee evasion persistence trojan

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Targets

- Target
  
  f8518c38784e9b78cae4bc2b90bfc289_JaffaCakes118
- Size
  
  14.7MB
- MD5
  
  f8518c38784e9b78cae4bc2b90bfc289
- SHA1
  
  1a58456029f8a0af14172b797150241a2565b8b9
- SHA256
  
  d6f43f31fce6ae40ebfad16c8c01d765a965a2aae9907ffcaefe293031356a75
- SHA512
  
  53489166d21faceae92bd7a48995b0fb03009b3b50cfaf05f0e03c78c372db2e810167fd406ab8cc1456e6874418bebb5b94e16450c61b86120e887a2cff3b44
- SSDEEP
  
  12288:khq8okPz+6/uWlQJVppppppppppppppppppppppppppppppppppppppppppppppB:dSz+R
Score

10^/10

tofsee evasion persistence trojan
- Tofsee
  Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
  trojan tofsee
- Windows security bypass
  evasion trojan
- Creates new service(s)
  persistence
- Modifies Windows Firewall
  evasion
- Sets service image path in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tofseeevasionpersistencetrojan

behavioral2

tofseeevasionpersistencetrojan