MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 493c4a7f6cdc0c6b3388b268aa38975c1bb52ea67f6415723a06a14213ee5d14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Tofsee

Vendor detections: 10

Intelligence 10 IOCs 1 YARA File information Comments

SHA256 hash:	493c4a7f6cdc0c6b3388b268aa38975c1bb52ea67f6415723a06a14213ee5d14
SHA3-384 hash:	c756f19ebe9513e84902d36f32c3f77861ddec1bba919a979ef75b1fd526145ff03c65990e401170b8f3dc1a5ee5be59
SHA1 hash:	d1e4a1ce2fd8d73f946b90f02fb374ee5f7396a6
MD5 hash:	685e782b22890f2be6a858d10e182030
humanhash:	nebraska-east-harry-johnny
File name:	685e782b22890f2be6a858d10e182030.exe
Download:	download sample
Signature	Tofsee Create hunting rule
File size:	146'944 bytes
First seen:	2021-08-24 14:07:11 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	3e77a5228ebd8b068a37deeb2c688fdb (6 x RaccoonStealer, 3 x RedLineStealer, 2 x Smoke Loader)
ssdeep	1536:CXOTQ3b+lA4/CkI/MjwaodysjiAeZUam5OGhj1ty5NTEtptJWRBriobhO2Yp2:C+64CMzodR+GBl1ty5NiSgM
Threatray	5'374 similar samples on MalwareBazaar
TLSH	T1F1E3BE1130A0C073D17346765AD9DBA0E92AF9226FB5498377E89B6F5F202D0BF2D352
dhash icon	4839b2b4e8c38890 (137 x RaccoonStealer, 37 x Smoke Loader, 30 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe Tofsee

abuse_ch

Tofsee C2:
http://185.234.247.35/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://185.234.247.35/	https://threatfox.abuse.ch/ioc/193640/

Intelligence

File Origin

# of uploads :

# of downloads :

549

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

685e782b22890f2be6a858d10e182030.exe

Verdict:

Suspicious activity

Analysis date:

2021-08-24 14:16:40 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/ab707341-0e83-40e0-af4f-9cfb8b787601

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/181940/

Detection(s):

SecuriteInfo.com.Trojan.Win32.Save.a.2026.6247.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Unauthorized injection to a recently created process

Sending a UDP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Connection attempt

Sending an HTTP POST request

Creating a file in the %temp% directory

Creating a process from a recently created file

Sending an HTTP GET request

Sending a custom TCP request

Launching a process

Searching for the window

Searching for analyzing tools

Reading critical registry keys

Deleting a recently created file

Creating a file in the %AppData% subdirectories

Setting browser functions hooks

Unauthorized injection to a system process

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Deleting of the original file

Enabling autorun by creating a file

Unauthorized injection to a browser process

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/873e0567-3a01-4485-aebd-e2e8535d3130

Result

Threat name:

Raccoon RedLine SmokeLoader Tofsee Vidar

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/838332

Signature

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code references suspicious native API functions

Benign windows process drops PE files

Changes security center settings (notifications, updates, antivirus, firewall)

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to steal Internet Explorer form passwords

Creates a thread in another existing process (thread injection)

Creates files in the system32 config directory

Deletes itself after installation

Detected unpacking (changes PE section rights)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

Maps a DLL or memory area into another process

May check the online IP address of the machine

Multi AV Scanner detection for submitted file

PE file contains section with special chars

Performs DNS queries to domains with low reputation

Query firmware table information (likely to detect VMs)

Sigma detected: Copying Sensitive Files with Credential Data

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to steal Crypto Currency Wallets

Uses known network protocols on non-standard ports

Yara detected Raccoon Stealer

Yara detected RedLine Stealer

Yara detected SmokeLoader

Yara detected Tofsee

Yara detected Vidar

Yara detected Vidar stealer

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/493c4a7f6cdc0c6b3388b268aa38975c1bb52ea67f6415723a06a14213ee5d14/

Threat name:

Win32.Trojan.Sabsik

Status:

Malicious

First seen:

2021-08-24 14:08:09 UTC

AV detection:

18 of 28 (64.29%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=je6eu73m3qggwm4iwjukuoexlqn3klvgp5sbk4r2a2quee7oluka._file

Verdict:

malicious

Result

Malware family:

tofsee

Score:

10/10

Tags:

family:buran family:raccoon family:redline family:smokeloader family:tofsee botnet:b8ef25fa9e346b7a31e4b6ff160623dd5fed2474 botnet:pro backdoor discovery evasion infostealer persistence ransomware spyware stealer themida trojan

Link:

https://tria.ge/reports/210824-mlz26cs6qx/

Behaviour

Suspicious use of WriteProcessMemory

Suspicious use of UnmapMainImage

Suspicious use of SendNotifyMessage

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: MapViewOfSection

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: EnumeratesProcesses

Modifies system certificate store

Interacts with shadow copies

Checks SCSI registry key(s)

Program crash

Enumerates physical storage devices

Launches sc.exe

Drops file in Program Files directory

Suspicious use of SetThreadContext

Suspicious use of NtSetInformationThreadHideFromDebugger

Checks whether UAC is enabled

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Enumerates connected drives

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Themida packer

Reads user/profile data of web browsers

Loads dropped DLL

Deletes itself

Checks BIOS information in registry

Modifies Windows Firewall

Executes dropped EXE

Downloads MZ/PE file

Creates new service(s)

Identifies VirtualBox via ACPI registry values (likely anti-VM)

Deletes shadow copies

Tofsee

Suspicious use of NtCreateProcessExOtherParentProcess

SmokeLoader

RedLine Payload

RedLine

Raccoon

Buran

Malware Config

C2 Extraction:

http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
95.217.117.91:49317