tofsee | f3c8f72b269efbdc3c0bb1c776ea3ac7863ab31a3e6d30aab28dbbf4f9f3b980 | Triage

Sharing

General

Target

2025-02-07_f9e35f1c8be8908caf8c817a858d2c4f_mafia
Size

11.0MB
Sample

250207-xmvs3stjay
MD5

f9e35f1c8be8908caf8c817a858d2c4f
SHA1

cd007199ef15ccbcbca51fe7b383b86902142fad
SHA256

f3c8f72b269efbdc3c0bb1c776ea3ac7863ab31a3e6d30aab28dbbf4f9f3b980
SHA512

3bd24a2b5257f64af3633fbafc77d98979e2d74daa4b8abbd70887b4381a47940a087fef270f938d00d730a83da4ecfad33eb1139e84b0315ca7e2bb19800c17
SSDEEP

49152:qqENTT4HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAk:qqIT

Score

10^/10

tofsee defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Targets

- Target
  
  2025-02-07_f9e35f1c8be8908caf8c817a858d2c4f_mafia
- Size
  
  11.0MB
- MD5
  
  f9e35f1c8be8908caf8c817a858d2c4f
- SHA1
  
  cd007199ef15ccbcbca51fe7b383b86902142fad
- SHA256
  
  f3c8f72b269efbdc3c0bb1c776ea3ac7863ab31a3e6d30aab28dbbf4f9f3b980
- SHA512
  
  3bd24a2b5257f64af3633fbafc77d98979e2d74daa4b8abbd70887b4381a47940a087fef270f938d00d730a83da4ecfad33eb1139e84b0315ca7e2bb19800c17
- SSDEEP
  
  49152:qqENTT4HAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAk:qqIT
Score

10^/10

tofsee defense_evasion discovery execution persistence privilege_escalation trojan
- Tofsee
  Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
  trojan tofsee
- Tofsee family
  tofsee
- Windows security bypass
  defense_evasion trojan
- Creates new service(s)
  persistence execution
- Downloads MZ/PE file
- Modifies Windows Firewall
  defense_evasion
- Sets service image path in registry
  persistence
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

tofseedefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan

behavioral2

tofseedefense_evasiondiscoveryexecutionpersistencetrojan