General

  • Target

    2024-09-21_55677129c3ec9b078fca74e0042b7667_mafia

  • Size

    12.0MB

  • Sample

    240921-x685tayglc

  • MD5

    55677129c3ec9b078fca74e0042b7667

  • SHA1

    0f316608d3481f66b6be8defcee658022220bb61

  • SHA256

    9242bfe755391afaabf0437648bd1d1219bfe22a3a9cc38aa400b8e586207d8e

  • SHA512

    ce397f4fdc64387094fba86c9a10c487dbf66a88e15e0aaf19cc98eec28f8e8b3b7b0ec2a5816b39f1524609636457a5ab719dfb9affd2904eb317e0eb8d24fe

  • SSDEEP

    6144:c+rWO2zeSPDjMXMH7Ll4aFpWVqIwUAP97GEwHrG2+e1x2:c+r1IeSXMXc7LlxWV4Ug97GZ+ej

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Targets

    • Target

      2024-09-21_55677129c3ec9b078fca74e0042b7667_mafia

    • Size

      12.0MB

    • MD5

      55677129c3ec9b078fca74e0042b7667

    • SHA1

      0f316608d3481f66b6be8defcee658022220bb61

    • SHA256

      9242bfe755391afaabf0437648bd1d1219bfe22a3a9cc38aa400b8e586207d8e

    • SHA512

      ce397f4fdc64387094fba86c9a10c487dbf66a88e15e0aaf19cc98eec28f8e8b3b7b0ec2a5816b39f1524609636457a5ab719dfb9affd2904eb317e0eb8d24fe

    • SSDEEP

      6144:c+rWO2zeSPDjMXMH7Ll4aFpWVqIwUAP97GEwHrG2+e1x2:c+r1IeSXMXc7LlxWV4Ug97GZ+ej

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks