General

  • Target

    $R4UBC5O.exe

  • Size

    208KB

  • Sample

    241011-rqmc8asaqr

  • MD5

    40f7ef5677b0ab00743c0a66b2d9c96a

  • SHA1

    a3b64e7d2731a21d9b574ab3f3a804474d5ce3ff

  • SHA256

    eb841ffe2d0c66d018d4d53b6a787a61c405c28def7bed3274814dddf793ae4a

  • SHA512

    9d8fd1de044f8bb399d6b6003abb573ecf00bfc270fa4d2c19f1d97d3dbc040557acf838e4673d5b859817aa9e76d008a5ac999320ee2b0ded409fe7de624689

  • SSDEEP

    3072:wZ4mW1Q1X5y/62wLAebhfcZsPj9w1RBeg8+/yGNV:i4ZA5862w79kZYkRBeA

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Targets

    • Target

      $R4UBC5O.exe

    • Size

      208KB

    • MD5

      40f7ef5677b0ab00743c0a66b2d9c96a

    • SHA1

      a3b64e7d2731a21d9b574ab3f3a804474d5ce3ff

    • SHA256

      eb841ffe2d0c66d018d4d53b6a787a61c405c28def7bed3274814dddf793ae4a

    • SHA512

      9d8fd1de044f8bb399d6b6003abb573ecf00bfc270fa4d2c19f1d97d3dbc040557acf838e4673d5b859817aa9e76d008a5ac999320ee2b0ded409fe7de624689

    • SSDEEP

      3072:wZ4mW1Q1X5y/62wLAebhfcZsPj9w1RBeg8+/yGNV:i4ZA5862w79kZYkRBeA

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks