MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 22c23de0a046b3652861d880ad53bbfca85448d0a6814d34151b1f359839dd37. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Tofsee

Vendor detections: 9

Intelligence 9 IOCs 2 YARA File information Comments

SHA256 hash:	22c23de0a046b3652861d880ad53bbfca85448d0a6814d34151b1f359839dd37
SHA3-384 hash:	93699f6f94a2574cf4575cb427b7a415cc052694a460d2504decb4b2c4f9bb24ba8324a57e95290c5be725550f0d1b94
SHA1 hash:	478c8b19b3b736f08b6a7475b29ece5abda36141
MD5 hash:	bd726f6f2f4408c541c619041d8c7c9f
humanhash:	august-oscar-edward-kansas
File name:	bd726f6f2f4408c541c619041d8c7c9f.exe
Download:	download sample
Signature	Tofsee Create hunting rule
File size:	245'248 bytes
First seen:	2021-09-30 05:41:24 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	5836b0745b42c6bdea4bd6e4cf5c6b7d (4 x RaccoonStealer, 4 x ArkeiStealer, 2 x RedLineStealer)
ssdeep	3072:/u6GsxPR7IqlzIQmoCaJnEd0aMn7y7w5Zg0H3SpHrm/G6eteZEF/ldP:/u5yxIOztgaJnjg0gL8DeteA/lV
Threatray	4'704 similar samples on MalwareBazaar
TLSH	T1E3349E1077E0C034F0B752BA49B9A3A9652DBDB19B24D1CB23D53BEE96346E0AD30747
File icon (PE):
dhash icon	60f8c8e8aa66a489 (1 x Tofsee)
Reporter	abuse_ch
Tags:	exe Tofsee

abuse_ch

Tofsee C2:
http://91.219.236.162/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://91.219.236.162/	https://threatfox.abuse.ch/ioc/228192/
185.80.53.81:15667	https://threatfox.abuse.ch/ioc/228316/

Intelligence

File Origin

# of uploads :

# of downloads :

753

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

bd726f6f2f4408c541c619041d8c7c9f.exe

Verdict:

Suspicious activity

Analysis date:

2021-09-30 05:45:50 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/677ac499-981f-4c06-9b9f-6bd3def815e1

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/193330/

Detection(s):

SecuriteInfo.com.Ransom.Stop.Z5.4.14770.UNOFFICIAL

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Malware family:

Generic Malware

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/f3a0a0b8-2f5a-4a72-a321-18ff2ce2c6ed

Result

Threat name:

Raccoon RedLine SmokeLoader Tofsee

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/861541

Signature

.NET source code contains very large array initializations

Antivirus detection for dropped file

Benign windows process drops PE files

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

Modifies the windows firewall

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Performs DNS queries to domains with low reputation

Query firmware table information (likely to detect VMs)

Sigma detected: Copying Sensitive Files with Credential Data

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious Svchost Process

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Uses known network protocols on non-standard ports

Uses netsh to modify the Windows network and firewall settings

Yara detected Raccoon Stealer

Yara detected RedLine Stealer

Yara detected SmokeLoader

Yara detected Tofsee

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/22c23de0a046b3652861d880ad53bbfca85448d0a6814d34151b1f359839dd37/

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2021-09-30 05:41:32 UTC

AV detection:

21 of 45 (46.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=elbd3yfai2zwkkdb3cak2u537sufisgqu2au2navdmptlgbz3u3q._file

Verdict:

malicious

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:gozi_rm3 family:raccoon family:redline family:smokeloader family:tofsee family:xmrig botnet:5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4 botnet:r botnet:second build backdoor banker discovery evasion infostealer miner persistence spyware stealer suricata themida trojan

Link:

https://tria.ge/reports/210930-gd3jkagfdm/

Behaviour

Checks SCSI registry key(s)

Delays execution with timeout.exe

Modifies data under HKEY_USERS

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Launches sc.exe

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Checks whether UAC is enabled

Looks up external IP address via web service

Checks BIOS information in registry

Deletes itself

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Themida packer

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry

Identifies VirtualBox via ACPI registry values (likely anti-VM)

XMRig Miner Payload

Gozi RM3

Raccoon

RedLine

RedLine Payload

SmokeLoader

Tofsee

Windows security bypass

suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)

suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt

xmrig

Malware Config

C2 Extraction:

http://fiskahlilian16.top/
http://paishancho17.top/
http://ydiannetter18.top/
http://azarehanelle19.top/
http://quericeriant20.top/
188.72.208.174:38430
asyndenera.xyz:15667