MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 8fd888d45037a4390dfa1675314acfd3184aed3386d34d2e3aec78aeb1b12cca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Tofsee
Vendor detections: 12
| SHA256 hash: | 8fd888d45037a4390dfa1675314acfd3184aed3386d34d2e3aec78aeb1b12cca |
|---|---|
| SHA3-384 hash: | 4c5edabf309cd2b655655ba67889f8038dc1d76f7d2cd65b719dd296a0566bfa2ca87ca46d9be89407f19fbbaee6aa47 |
| SHA1 hash: | 294bdf310b19b9da2bce718aecaab248d140f31c |
| MD5 hash: | 7e7b0f6e22b2eb617c6f6c29debb4da7 |
| humanhash: | washington-whiskey-robert-undress |
| File name: | 7e7b0f6e22b2eb617c6f6c29debb4da7 |
| Download: | download sample |
| Signature | Tofsee |
| File size: | 271'872 bytes |
| First seen: | 2022-04-20 10:31:18 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | afec21e33dcabd8295ee97c23e4ac7df (2 x Tofsee) |
| ssdeep | 6144:XdJJ60N1dH0pWzzx3LrArqkFP4xOeraDq6Ur:tJJ6odUpWzzxfAe+PGI |
| Threatray | 257 similar samples on MalwareBazaar |
| TLSH | T100448E01BB90D035F5B766F8497A83A8B93EBDA19B2051CB32D53AEE56346D4EC30317 |
| TrID | 40.5% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 17.0% (.SCR) Windows screen saver (13101/52/3) 13.6% (.EXE) Win64 Executable (generic) (10523/12/4) 8.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.5% (.EXE) Win16 NE executable (generic) (5038/12/1) |
| File icon (PE): |  |
| dhash icon | b2dacabecee6baa6 (148 x RedLineStealer, 145 x Stop, 100 x Smoke Loader) |
| Reporter |  zbetcheckin |
| Tags: | 32 exe Tofsee |
Intelligence
File Origin
# of uploads :
1
# of downloads :
501
Origin country :
n/a
Vendor Threat Intelligence
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Creating a file in the %temp% directory
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching a process
Creating a file
Launching the process to change the firewall settings
Creating a process from a recently created file
Creating a service
Launching a service
Sending a custom TCP request
Launching the default Windows debugger (dwwin.exe)
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun for a service
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
greyware
Result
Verdict:
SUSPICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Tofsee
Verdict:
Malicious
Result
Threat name:
Tofsee
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Behaviour
Behavior Graph:
n/a
Threat name:
Win32.Ransomware.StopCrypt
Status:
Malicious
First seen:
2022-04-20 10:34:50 UTC
File Type:
PE (Exe)
Extracted files:
20
AV detection:
20 of 26 (76.92%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
+ 247 additional samples on MalwareBazaar
Result
Malware family:
xmrig
Score:
10/10
Tags:
family:tofsee family:xmrig evasion miner persistence trojan
Behaviour
Modifies data under HKEY_USERS
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Launches sc.exe
Drops file in System32 directory
Suspicious use of SetThreadContext
Checks computer location settings
Deletes itself
Creates new service(s)
Executes dropped EXE
Modifies Windows Firewall
Sets service image path in registry
XMRig Miner Payload
xmrig
Tofsee
Windows security bypass
Malware Config
C2 Extraction:
niflheimr.cn
jotunheim.name
jotunheim.name
Unpacked files
SH256 hash:
8a45b9fe9a64bef219d7bada4de2e61bd6daa96d913b1d0be5cb4faa83d4b70b
MD5 hash:
69126d6d1a71a666204535aa01e990f4
SHA1 hash:
970ead4d879aace069bf19c80928031df9af0dd1
Detections:
win_tofsee_w0
Parent samples :
8fd888d45037a4390dfa1675314acfd3184aed3386d34d2e3aec78aeb1b12cca
140a1853c2a319ccd4f2fd07cf1712a15adab77c81c66d01f876ef17806889c1
8fc3150c1a665a902a55f53053966ee6782420059be6d0151efaf7eebaf48e73
4cc8f23e22db5a8201474e9d46e986ad4772b8ea91c9e281242f2cb5f10dae0b
3ce8363d05d1015ebd88250aad7c26b2ec0383b3e8a1634aec0cd86900f29324
140a1853c2a319ccd4f2fd07cf1712a15adab77c81c66d01f876ef17806889c1
8fc3150c1a665a902a55f53053966ee6782420059be6d0151efaf7eebaf48e73
4cc8f23e22db5a8201474e9d46e986ad4772b8ea91c9e281242f2cb5f10dae0b
3ce8363d05d1015ebd88250aad7c26b2ec0383b3e8a1634aec0cd86900f29324
SH256 hash:
8fd888d45037a4390dfa1675314acfd3184aed3386d34d2e3aec78aeb1b12cca
MD5 hash:
7e7b0f6e22b2eb617c6f6c29debb4da7
SHA1 hash:
294bdf310b19b9da2bce718aecaab248d140f31c
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | MALWARE_Win_Tofsee |
|---|---|
| Author: | ditekSHen |
| Description: | Detects Tofsee |
| Rule name: | win_tofsee_w0 |
|---|---|
| Author: | akrasuski1 |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://62.204.41.46:8080/a.exe