tofsee | 4d660290171a05e3baebf9a31a6a839f1803b592e60555d01685b4a961e9631c[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
4d660290171a05e3baebf9a31a6a839f1803b592e60555d01685b4a961e9631c.bin
Size 12.6MB
Sample261113-dtxfpszt5k
SHA256 4d660290171a05e3baebf9a31a6a839f1803b592e60555d01685b4a961e9631c
MD5 01489e25794870b4db7673184b29ffb4
SHA1 0231ee9136c94f167e05c4901a78c2d99193fc79
SHA512 1e2555031931a9c6f8db118617fb129316b42b8b0bf803666fe165129fba8510f0043f987e19df8915afa25722b235a979a98209c56ecac1ab5c9174108c325f
SSDEEP 49152:GKpbWrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvn:GO
TLSH
T14ED641AA76BA5ED6D08A0B3C0CB1D5174EACF634083A597251D140CF58EE2CAD73CBB5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan tofsee

Malware Config

Extracted

Family

tofsee

defeatwax.ru
refabyd.info

Signatures

Family: Tofsee
Backdoor/botnet which carries out malicious activities based on commands from a C2 server.
trojan tofsee

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d660290171a05e3baebf9a31a6a839f1803b592e60555d01685b4a961e9631c.bin

File Explorer

4d660290171a05e3baebf9a31a6a839f1803b592e60555d01685b4a961e9631c.bin

.exe 12.6MB

4d660290171a05e3baebf9a31a6a839f1803b592e60555d01685b4a961e9631c.bin

IMPHASH b7c5b33e924247ab3dfc746dbe882c16
SHA256 4d660290171a05e3baebf9a31a6a839f1803b592e60555d01685b4a961e9631c
MD5 01489e25794870b4db7673184b29ffb4
SHA1 0231ee9136c94f167e05c4901a78c2d99193fc79
SHA512 1e2555031931a9c6f8db118617fb129316b42b8b0bf803666fe165129fba8510f0043f987e19df8915afa25722b235a979a98209c56ecac1ab5c9174108c325f
SSDEEP 49152:GKpbWrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvrvn:GO
TLSH
T14ED641AA76BA5ED6D08A0B3C0CB1D5174EACF634083A597251D140CF58EE2CAD73CBB5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39531

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

ConvertSidToStringSidA AllocateAndInitializeSid CreateProcessWithLogonW RegCreateKeyExA StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerA SetServiceStatus RegDeleteValueA RegGetKeySecurity RegSetKeySecurity RegSetValueExA GetLengthSid GetFileSecurityA GetSecurityDescriptorOwner EqualSid InitializeSecurityDescriptor SetSecurityDescriptorOwner SetFileSecurityA GetSecurityDescriptorDacl GetAce DeleteAce SetSecurityDescriptorDacl RegQueryValueExA RegEnumKeyA RegOpenKeyExA RegEnumValueA GetUserNameW LookupAccountNameW LookupAccountNameA GetUserNameA RegCloseKey CheckTokenMembership FreeSid

kernel32

GetVolumeInformationA GetComputerNameA GetTickCount GetCurrentProcess GetModuleHandleA GetSystemInfo GetVersionExA lstrcmpiA lstrlenA Sleep lstrcpynA InterlockedExchange GetCurrentThreadId ExitProcess GetOverlappedResult WaitForSingleObject GetLastError WriteFile ReadFile CreateFileA DisconnectNamedPipe ConnectNamedPipe CreateNamedPipeA CloseHandle LoadLibraryA GetEnvironmentVariableA DeleteFileA IsBadWritePtr IsBadCodePtr lstrcpyA lstrcmpA VirtualProtect IsBadReadPtr VirtualFree WriteProcessMemory VirtualAllocEx VirtualAlloc SetFilePointer GetFileSize SetFileAttributesA GetDiskFreeSpaceA GetWindowsDirectoryA GetProcAddress LocalFree GetFileAttributesExA LocalAlloc CreateProcessA GetTempPathA SystemTimeToFileTime GetSystemTime DeviceIoControl CreateFileW GetModuleFileNameA ResumeThread SetThreadContext TerminateProcess GetThreadContext lstrcatA CreateThread GetDriveTypeA GetCommandLineA SetUnhandledExceptionFilter SetErrorMode InterlockedIncrement GetLocalTime GetTimeZoneInformation FileTimeToLocalFileTime FileTimeToSystemTime InterlockedDecrement HeapSize GetSystemTimeAsFileTime MultiByteToWideChar lstrlenW GetStartupInfoW GetProcessHeap HeapAlloc HeapReAlloc HeapFree FreeLibrary CreateEventA GetSystemDirectoryA

oleaut32

SysAllocStringByteLen

shell32

ShellExecuteA ShellExecuteExW

user32

wsprintfA CharToOemA

ws2_32

ioctlsocket __WSAFDIsSet WSAStartup send connect setsockopt bind listen accept getsockname ntohl gethostname socket select recv ntohs ntohs sendto gethostbyaddr inet_ntoa gethostbyname inet_addr getpeername closesocket

dbghelp

StackWalk64