General

  • Target

    917c560ccf9f6e6c0f05e0e9229edeae_JaffaCakes118

  • Size

    11.1MB

  • Sample

    241124-ajb58szphl

  • MD5

    917c560ccf9f6e6c0f05e0e9229edeae

  • SHA1

    3bf4053d4738ef001bad8159fe0038ec86b6b8be

  • SHA256

    a8180497b3670425ac073f544fa2bb502f94e064238ead126a73bd0b3683af9b

  • SHA512

    f2e058b532775ef9ca8a60d1c8fa8be5fdb905b8cb56e573d5198289d0133a7623a980e9597e14e0ba20ec713c26f9c9c6bf31c64d8df04cc8f50165a833c03b

  • SSDEEP

    196608:BNIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIX:7IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIw

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Targets

    • Target

      917c560ccf9f6e6c0f05e0e9229edeae_JaffaCakes118

    • Size

      11.1MB

    • MD5

      917c560ccf9f6e6c0f05e0e9229edeae

    • SHA1

      3bf4053d4738ef001bad8159fe0038ec86b6b8be

    • SHA256

      a8180497b3670425ac073f544fa2bb502f94e064238ead126a73bd0b3683af9b

    • SHA512

      f2e058b532775ef9ca8a60d1c8fa8be5fdb905b8cb56e573d5198289d0133a7623a980e9597e14e0ba20ec713c26f9c9c6bf31c64d8df04cc8f50165a833c03b

    • SSDEEP

      196608:BNIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIIX:7IIIIIIIIIIIIIIIIIIIIIIIIIIIIIIw

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Tofsee family

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks