MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5a755c3fa92a24bae2d0d3fc1e2a743ed11e159f3327aeb685f8118823453a59. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Tofsee

Vendor detections: 10

Intelligence 10 IOCs 1 YARA File information Comments

SHA256 hash:	5a755c3fa92a24bae2d0d3fc1e2a743ed11e159f3327aeb685f8118823453a59
SHA3-384 hash:	8991b1af9ecd4f2d6e67cdef0290bf8144ca559ae068b0b2fd9655e6fc0da59eec13b1322eae010e143bd0660c1823f8
SHA1 hash:	edf064f4b9233f7eb4f0c83a5cdb9cdd568278ea
MD5 hash:	d4d66258546efbcc87356f6ecfa0e925
humanhash:	fruit-india-floor-triple
File name:	d4d66258546efbcc87356f6ecfa0e925.exe
Download:	download sample
Signature	Tofsee Create hunting rule
File size:	172'544 bytes
First seen:	2021-08-28 19:50:47 UTC
Last seen:	2021-08-28 21:07:51 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	065a584d0d50807005a7c41fcb9adea6 (6 x RaccoonStealer, 2 x RedLineStealer, 1 x DanaBot)
ssdeep	3072:aZmgrmSXo03dk1a+5EA7t9DU+jRHwhZoWC9sI5/DuT61m:ir/XoglyHHwhZU9sI5/
Threatray	4'010 similar samples on MalwareBazaar
TLSH	T1AFF3BE0436B0C57BF9C5093444E9EB91EA3BF8F36A75424B3654176F3E212C0562EAD7
dhash icon	4839b2b0e8c38890 (105 x RaccoonStealer, 38 x Smoke Loader, 33 x RedLineStealer)
Reporter	abuse_ch
Tags:	exe Tofsee

abuse_ch

Tofsee C2:
http://84.246.85.16/

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://84.246.85.16/	https://threatfox.abuse.ch/ioc/201706/

Intelligence

File Origin

# of uploads :

# of downloads :

654

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

d4d66258546efbcc87356f6ecfa0e925.exe

Verdict:

Suspicious activity

Analysis date:

2021-08-28 19:52:49 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/3c4cd5fa-c4b5-4a81-bc8c-90db73e2b6fd

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/183144/

Detection(s):

SecuriteInfo.com.Variant.Fragtor.12658.25904.14437.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Sending a UDP request

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

DNS request

Connection attempt

Sending an HTTP POST request

Sending an HTTP GET request

Creating a file in the %temp% directory

Creating a process from a recently created file

Running batch commands

Creating a process with a hidden window

Moving a file to the Windows subdirectory

Launching a process

Sending a custom TCP request

Creating a service

Launching a service

Deleting a recently created file

Launching the default Windows debugger (dwwin.exe)

Launching the process to change the firewall settings

Creating a file

Connection attempt to an infection source

Creating a file in the Windows subdirectories

Reading critical registry keys

Unauthorized injection to a recently created process

Enabling autorun for a service

Unauthorized injection to a recently created process by context flags manipulation

Query of malicious DNS domain

Forced shutdown of a system process

Sending a TCP request to an infection source

Stealing user critical data

Deleting of the original file

Enabling autorun by creating a file

Unauthorized injection to a system process

Adding exclusions to Windows Defender

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/70aa88bf-f790-4004-b4ef-58ef972d1122

Result

Threat name:

Raccoon RedLine SmokeLoader Tofsee Xmrig

Detection:

malicious

Classification:

troj.spyw.evad.mine

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/840844

Signature

.NET source code contains potential unpacker

.NET source code contains very large strings

Allocates memory in foreign processes

Antivirus detection for dropped file

Antivirus detection for URL or domain

Benign windows process drops PE files

Changes security center settings (notifications, updates, antivirus, firewall)

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to inject code into remote processes

Contains functionality to steal Internet Explorer form passwords

Creates a thread in another existing process (thread injection)

Creates files in alternative data streams (ADS)

Deletes itself after installation

Detected unpacking (changes PE section rights)

Drops executables to the windows directory (C:\Windows) and starts them

Found strings related to Crypto-Mining

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Maps a DLL or memory area into another process

May check the online IP address of the machine

Modifies the windows firewall

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

PE file contains section with special chars

PE file has nameless sections

Performs DNS queries to domains with low reputation

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses process hollowing technique

Sigma detected: Copying Sensitive Files with Credential Data

Sigma detected: Suspect Svchost Activity

Sigma detected: Suspicious Svchost Process

System process connects to network (likely due to code injection or exploit)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to resolve many domain names, but no domain seems valid

Uses known network protocols on non-standard ports

Uses netsh to modify the Windows network and firewall settings

Writes to foreign memory regions

Yara detected Raccoon Stealer

Yara detected RedLine Stealer

Yara detected SmokeLoader

Yara detected Tofsee

Yara detected Xmrig cryptocurrency miner

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5a755c3fa92a24bae2d0d3fc1e2a743ed11e159f3327aeb685f8118823453a59/

Threat name:

Win32.Trojan.Fragtor

Status:

Malicious

First seen:

2021-08-28 19:51:04 UTC

AV detection:

21 of 42 (50.00%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=lj2vyp5jfislvywq2p6b4ktuh3ir4fm7gmt25nuf7aiyqi2fhjmq._file

Verdict:

suspicious

Tofsee

5c755d14199295a752594d0bb2a4c6bd7ede35ea7c078499fc7fff96451b2530

Tofsee

7207f2cb25a9c37cded5eff0dc7707d7ef1c4f42ffb8b93aeab22f40d551a2de

Tofsee

907f6b8f9c0e1e15fb052deaa36b96fe53c6bd8d1e3b15f9297b4f1295c16271

Tofsee

c87fe4ff57a5464c0155bd1a8a924a2d77a79fdf87cba206e9ef5ac0d0f848cf

Tofsee

f4e1fc78ba0a65bde5687a67eb89e20166e062356b77227c9e0211060bd14dc8

Tofsee

f74c97d626730018ba9a8dd5e6fb806bfcc42d15a8b20ef328cc5f0d6a052ccc

Tofsee

faf49f9b1d785e077bd17c37eddec80c57d3ffc843a745e6854c9b7a6812b7e0

Tofsee

+ 4'000 additional samples on MalwareBazaar

Result

Malware family:

xmrig

Score:

10/10

Tags:

family:asyncrat family:bitrat family:buran family:raccoon family:redline family:smokeloader family:stormkitty family:tofsee family:xmrig botnet:1000 botnet:fe582536ec580228180f270f7cb80a867860e010 botnet:mix botnet:sergey botnet:superstar75737 botnet:word1 backdoor discovery evasion infostealer miner persistence ransomware rat spyware stealer suricata themida trojan upx

Link:

https://tria.ge/reports/210828-xssa4ge7lx/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Creates scheduled task(s)

Interacts with shadow copies

Modifies data under HKEY_USERS

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Program Files directory

Launches sc.exe

Drops file in System32 directory

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

Accesses cryptocurrency files/wallets, possible credential harvesting

Adds Run key to start application

Checks installed software on the system

Checks whether UAC is enabled

Drops desktop.ini file(s)

Enumerates connected drives

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Looks up geolocation information via web service

Checks BIOS information in registry

Deletes itself

Loads dropped DLL

Reads user/profile data of local email clients

Reads user/profile data of web browsers

Themida packer

Creates new service(s)

Downloads MZ/PE file

Executes dropped EXE

Modifies Windows Firewall

Sets service image path in registry

UPX packed file

Async RAT payload

Deletes shadow copies

Identifies VirtualBox via ACPI registry values (likely anti-VM)

XMRig Miner Payload

AsyncRat

BitRAT

BitRAT Payload

Buran

Raccoon

RedLine

RedLine Payload

SmokeLoader

StormKitty

StormKitty Payload

Tofsee

Windows security bypass

suricata: ET MALWARE StormKitty Data Exfil via Telegram

xmrig

Malware Config

C2 Extraction:

http://readinglistforaugust1.xyz/
http://readinglistforaugust2.xyz/
http://readinglistforaugust3.xyz/
http://readinglistforaugust4.xyz/
http://readinglistforaugust5.xyz/
http://readinglistforaugust6.xyz/
http://readinglistforaugust7.xyz/
http://readinglistforaugust8.xyz/
http://readinglistforaugust9.xyz/
http://readinglistforaugust10.xyz/
http://readinglistforaugust1.site/
http://readinglistforaugust2.site/
http://readinglistforaugust3.site/
http://readinglistforaugust4.site/
http://readinglistforaugust5.site/
http://readinglistforaugust6.site/
http://readinglistforaugust7.site/
http://readinglistforaugust8.site/
http://readinglistforaugust9.site/
http://readinglistforaugust10.site/
http://readinglistforaugust1.club/
http://readinglistforaugust2.club/
http://readinglistforaugust3.club/
http://readinglistforaugust4.club/
http://readinglistforaugust5.club/
http://readinglistforaugust6.club/
http://readinglistforaugust7.club/
http://readinglistforaugust8.club/
http://readinglistforaugust9.club/
http://readinglistforaugust10.club/
51.254.68.139:15009
94.26.249.88:1902
manazyxsa.xyz:80
95.181.152.190:33007
94.103.9.138:80