tofsee | 996e55ff7dfab4bdc3cd2bd847658ac6da3c5a1e8634e5e9d0e64bcb784ea52b | Triage

Sharing

General

Target

2025-01-29_9d96d9c5193edd88a9d0186b176ce37c_mafia
Size

13.5MB
Sample

250129-v4z31stjgk
MD5

9d96d9c5193edd88a9d0186b176ce37c
SHA1

2bb0f83db1e961217eaf2c4a9ffbf638fd9e22e8
SHA256

996e55ff7dfab4bdc3cd2bd847658ac6da3c5a1e8634e5e9d0e64bcb784ea52b
SHA512

d254a77387342070434f346f52faf1cb5ceca3df4d6331eb558685704f180774ad64be410923db6cba0c30978df07cd40e50f99bb85fd7d98e836300c367f8bb
SSDEEP

3072:zLBgXOXcdW8tar7vGdq8c7YMl2b8anmMXnb58XuDP9het3Zv1oSW1za2E+w5C2/Y:6OMdRQr7OB0ypmMXnl8XEPM3noSWOC

Score

10^/10

tofsee defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Targets

- Target
  
  2025-01-29_9d96d9c5193edd88a9d0186b176ce37c_mafia
- Size
  
  13.5MB
- MD5
  
  9d96d9c5193edd88a9d0186b176ce37c
- SHA1
  
  2bb0f83db1e961217eaf2c4a9ffbf638fd9e22e8
- SHA256
  
  996e55ff7dfab4bdc3cd2bd847658ac6da3c5a1e8634e5e9d0e64bcb784ea52b
- SHA512
  
  d254a77387342070434f346f52faf1cb5ceca3df4d6331eb558685704f180774ad64be410923db6cba0c30978df07cd40e50f99bb85fd7d98e836300c367f8bb
- SSDEEP
  
  3072:zLBgXOXcdW8tar7vGdq8c7YMl2b8anmMXnb58XuDP9het3Zv1oSW1za2E+w5C2/Y:6OMdRQr7OB0ypmMXnl8XEPM3noSWOC
Score

10^/10

tofsee defense_evasion discovery execution persistence privilege_escalation trojan
- Tofsee
  Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
  trojan tofsee
- Tofsee family
  tofsee
- Windows security bypass
  defense_evasion trojan
- Creates new service(s)
  persistence execution
- Modifies Windows Firewall
  defense_evasion
- Sets service image path in registry
  persistence
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

behavioral2

tofseedefense_evasiondiscoveryexecutionpersistencetrojan