tofsee | 411c12f3ffdfc457b7e96b53eb9f82170e2d065a09157c82c879c335f80afe18 | Triage

Sharing

General

Target

271d95e58c572c43840b2821abcc4ef0_JaffaCakes118
Size

143KB
Sample

240508-2y63pscc4t
MD5

271d95e58c572c43840b2821abcc4ef0
SHA1

45b8f42821059fab7c65139875855e99bf42678d
SHA256

411c12f3ffdfc457b7e96b53eb9f82170e2d065a09157c82c879c335f80afe18
SHA512

2c558900cfaab4161779b80a10197c75c0f3d001ff25b31477fdec1e3457cde1fe8d9291c9a68841956101c5f2e1ece1779ca21417ad977e206e8f27301da233
SSDEEP

3072:Is6ZY7v9ocPspRvaMnY7Q0qzhBpJ6E5WcWcpxOcvocjc:yyLsXaAYQb/zV

Score

10^/10

tofsee evasion execution persistence trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Targets

- Target
  
  271d95e58c572c43840b2821abcc4ef0_JaffaCakes118
- Size
  
  143KB
- MD5
  
  271d95e58c572c43840b2821abcc4ef0
- SHA1
  
  45b8f42821059fab7c65139875855e99bf42678d
- SHA256
  
  411c12f3ffdfc457b7e96b53eb9f82170e2d065a09157c82c879c335f80afe18
- SHA512
  
  2c558900cfaab4161779b80a10197c75c0f3d001ff25b31477fdec1e3457cde1fe8d9291c9a68841956101c5f2e1ece1779ca21417ad977e206e8f27301da233
- SSDEEP
  
  3072:Is6ZY7v9ocPspRvaMnY7Q0qzhBpJ6E5WcWcpxOcvocjc:yyLsXaAYQb/zV
Score

10^/10

tofsee evasion execution persistence trojan
- Tofsee
  Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
  trojan tofsee
- Windows security bypass
  evasion trojan
- Creates new service(s)
  persistence execution
- Modifies Windows Firewall
  evasion
- Sets service image path in registry
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tofseeevasionexecutionpersistencetrojan

behavioral2

tofseeevasionexecutionpersistencetrojan