MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca81d370ff7e2f2b429d2c1ff109a351f66f5bb9799d34c424aaaac684ed59a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Tofsee


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca81d370ff7e2f2b429d2c1ff109a351f66f5bb9799d34c424aaaac684ed59a4
SHA3-384 hash: dc87bf9ec126beeb02df2e4b6c66aef79c5ffa2c80a4644c31e21f208943bb5d1a8a3d3d51fe6b6aee712a95c14a8aa1
SHA1 hash: 6678722fb1a3889b18d7ba42ec509e1f84521dd3
MD5 hash: 41cea46a44d655ab07e414f88b07260a
humanhash: july-undress-kansas-lamp
File name:41cea46a44d655ab07e414f88b07260a.exe
Download: download sample
Signature Tofsee
Create hunting rule
File size:174'080 bytes
First seen:2022-09-23 10:20:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0a3409353d33590fdfda8576bcd4d9af (1 x Tofsee)
ssdeep 3072:v8hLpO65z0fJRIA/M3wxyLiBI6Iz/PkW4n:GLp3AabwqpZ
TLSH T16804D1D07AB0D43EC43200787C26D3E2A9696C129A614947375BBF5F6E713819EEF31A
TrID 48.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
16.4% (.EXE) Win64 Executable (generic) (10523/12/4)
10.2% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.0% (.EXE) Win32 Executable (generic) (4505/5/1)
File icon (PE):PE icon
dhash icon b6dacabecee6baa6 (72 x Stop, 68 x RedLineStealer, 55 x Smoke Loader)
Reporter abuse_ch
Tags:exe Tofsee


Avatar
abuse_ch
Tofsee C2:
5.252.118.34:37991

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
5.252.118.34:37991 https://threatfox.abuse.ch/ioc/851289/

Intelligence

File Origin
# of uploads :
1
# of downloads :
343
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
ca81d370ff7e2f2b429d2c1ff109a351f66f5bb9799d34c424aaaac684ed59a4.zip
Verdict:
Malicious activity
Analysis date:
2022-09-23 10:38:40 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/dc774a36-af36-4c26-96a5-e511b51ce9da

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/312573/
Detection(s):
Win.Packed.Crypterx-9954995-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for synchronization primitives
Sending a custom TCP request
Reading critical registry keys
Сreating synchronization primitives
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
DNS request
Sending an HTTP POST request
Sending an HTTP GET request
Connecting to a non-recommended domain
Creating a file in the %temp% directory
Creating a process from a recently created file
Launching a process
Running batch commands
Creating a process with a hidden window
Unauthorized injection to a system process
Enabling autorun by creating a file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
75%
Tags:
anti-vm emotet greyware mokes packed
Link:
https://www.filescan.io/uploads/632d88e436ba812561b17d14/reports/0214f6e2-2b1d-47b8-8880-6f63d6ed05da/overview
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/b039763d-a88c-4f3e-bba1-b0111e86e3cb
Result
Threat name:
GRQ Scam, RedLine, SmokeLoader, Tofsee,
Create hunting rule
Detection:
malicious
Classification:
phis.troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1075835
Signature
Allocates memory in foreign processes
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Connects to a pastebin service (likely for C&C)
Creates a thread in another existing process (thread injection)
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found many strings related to Crypto-Wallets (likely being stolen)
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Injects code into the Windows Explorer (explorer.exe)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Performs DNS queries to domains with low reputation
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Uses known network protocols on non-standard ports
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Yara detected GRQ Scam
Yara detected RedLine Stealer
Yara detected SmokeLoader
Yara detected Tofsee
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 708377 Sample: 1stOQAhUrG.exe Startdate: 23/09/2022 Architecture: WINDOWS Score: 100 60 svartalfheim.top 2->60 62 dba692117be7b6d3480fe5220fdd58b38bf.xyz 2->62 64 13 other IPs or domains 2->64 80 Snort IDS alert for network traffic 2->80 82 Multi AV Scanner detection for domain / URL 2->82 84 Malicious sample detected (through community Yara rule) 2->84 86 16 other signatures 2->86 10 1stOQAhUrG.exe 2->10         started        13 tiigbfr 2->13         started        signatures3 process4 signatures5 102 Detected unpacking (changes PE section rights) 10->102 104 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 10->104 106 Maps a DLL or memory area into another process 10->106 15 explorer.exe 13 10->15 injected 108 Machine Learning detection for dropped file 13->108 110 Checks if the current machine is a virtual machine (disk enumeration) 13->110 112 Creates a thread in another existing process (thread injection) 13->112 process6 dnsIp7 66 cdn-115.anonfiles.com 195.96.151.67, 443, 49747 UTA-ASAT unknown 15->66 68 cdn-119.anonfiles.com 195.96.151.71, 443, 49732 UTA-ASAT unknown 15->68 70 14 other IPs or domains 15->70 50 C:\Users\user\AppData\Roaming\tiigbfr, PE32 15->50 dropped 52 C:\Users\user\AppData\Local\TempFCE.exe, PE32 15->52 dropped 54 C:\Users\user\AppData\Local\Temp\DB0C.exe, PE32 15->54 dropped 56 4 other malicious files 15->56 dropped 72 System process connects to network (likely due to code injection or exploit) 15->72 74 Benign windows process drops PE files 15->74 76 Injects code into the Windows Explorer (explorer.exe) 15->76 78 3 other signatures 15->78 20 D0EA.exe 15->20         started        23 EFCE.exe 15->23         started        25 C36C.exe 2 15->25         started        28 11 other processes 15->28 file8 signatures9 process10 file11 88 Multi AV Scanner detection for dropped file 20->88 90 Machine Learning detection for dropped file 20->90 92 Writes to foreign memory regions 20->92 30 AppLaunch.exe 20->30         started        94 Allocates memory in foreign processes 23->94 96 Injects a PE file into a foreign processes 23->96 32 AppLaunch.exe 23->32         started        58 C:\Users\user\AppData\Local\...\ydasleap.exe, PE32 25->58 dropped 98 Detected unpacking (changes PE section rights) 25->98 100 Detected unpacking (overwrites its own PE header) 25->100 34 cmd.exe 25->34         started        36 cmd.exe 25->36         started        38 wusa.exe 25->38         started        40 wusa.exe 25->40         started        42 AppLaunch.exe 2 28->42         started        44 conhost.exe 28->44         started        signatures12 process13 process14 46 conhost.exe 34->46         started        48 conhost.exe 36->48         started       
Detection:
tofsee
Create hunting rule
Link:
https://mwdb.cert.pl/sample/ca81d370ff7e2f2b429d2c1ff109a351f66f5bb9799d34c424aaaac684ed59a4/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2022-09-23 10:21:07 UTC
File Type:
PE (Exe)
Extracted files:
34
AV detection:
23 of 26 (88.46%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=zka5g4h7pyxswqu5fqp7ccndkh3g6w5zpgotjrbevkvmnbhnlgsa._file
Verdict:
malicious
Result
Malware family:
xmrig
Create hunting rule
Score:
  10/10
Tags:
family:redline family:smokeloader family:tofsee family:xmrig botnet:bog923 botnet:logsdiller cloud (sup: @mr_golds) backdoor evasion infostealer miner persistence trojan
Link:
https://tria.ge/reports/220923-mdncjahhcj/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Launches sc.exe
Suspicious use of SetThreadContext
Checks computer location settings
Creates new service(s)
Downloads MZ/PE file
Executes dropped EXE
Modifies Windows Firewall
XMRig Miner payload
Detects Smokeloader packer
RedLine
RedLine payload
SmokeLoader
Tofsee
xmrig
Malware Config
C2 Extraction:
77.73.134.27:8163
svartalfheim.top
jotunheim.name
jamesmillion.xyz:29329
Verdict:
Informative
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/5fa4008c-ea8e-40fb-b846-e67b7fa5fecc
Unpacked files
SH256 hash:
9792b2f0eb2b1aad1a7416e4ad4099d0551758bb9dd65ef2c8aff26192d20c9c
MD5 hash:
9eec547db5a291f2695c6147dbc7177d
SHA1 hash:
67a643f41e17f11a2d27d84037392012b57913f9
Detections:
win_smokeloader_a2
Create hunting rule
SmokeLoaderStage2
Create hunting rule
Link:
https://www.unpac.me/results/cdf07480-4523-4c7f-82d8-afeeaedddb56/
Parent samples :
de2912f0955e066d268cb9ea411c31d49878d94be3ce444e1e33ef00b0d14407
fc06b0515b1d0acff129e4016f0c0b8f6827c17c04228bdf100a73825df0c078
18beed2a315224d9fd79f3298dd91518b99c16f49d38796485d75cac2a135b1b
c0265c728821cab03a2487165bb49b734a653aefbdd2a9a67768efff4cca172e
cfc5fcbf9856cf28838a27f1779e0ab860a7886329cd368f726e980dc72e266e
b4770db42a8117271e82b3b3afc128dea4f4090322b326477498f60c9fe21059
48f43556d196cdd49c48e06b4a9d34aef99847534b056afca5a00dc07fb1acc3
c5239df535857220bf4a1d11f1281ceb168ffb0cd7b0e0cd37fb556e0cb04193
1f63d7b1fc905bcef2d468fd52e37515d568fbd0d9656c62cd9eda173f21f4e4
a519a31a304485bc64fa4796655641ab62e5c07f35b34ede98de5c6bb0082ca7
427c95ff1528c467e90476ee77b6f7b04a587113629e254e82e5bbdfcbf92bb7
11212a25a03d681bfb1a7b537b8e066c09d506a30728bd377d47480d8274847a
ec2327749fcfe81de5944c76521528d4df2c841e2ab56f728a2a2998ac390f53
7737c4db7c1bb8a1765ea4b6346da60a7bf4146b11307053254a266e3602cc8f
08879335463d74ba06f8cf8548a59e3a246a37d2bacec19937054f0ee3bf819a
fa1597898a74d717afcad5809dad53880d34f25f106736bb3fd4835e93204ae1
da59178b5bdf3c372a7ee466713990a0021e2ac5880b8d19b2ddb035ca0e2c9c
ca81d370ff7e2f2b429d2c1ff109a351f66f5bb9799d34c424aaaac684ed59a4
04c998230407616fc3f626c05a523583eb659818834ce07692a4de9fe678a732
f661ec60e29f3bd12a3d4db867d37cd78ab2104f7c27b63624433a66d514113b
789edea2f682ba7f2caf76a0a3ca8559c5204627fd4a829cc863f06017686ccf
a4b18ce54301fdad6c022f031fb60c656b730ac90399ee7b2a8ba2f675b0297e
0dcb665bf83e5de02dac89f4c72741b5330fa15bd8bb45508a756d9d6f5f3a72
4eb0e488227caebf4bcedbff8768d84cd46f4588cfb067410ab298c24afdc3b5
ac200dfd46cb14b4c59f30198d261a64a5a90972ec0439d0da7ec6c2fc209a69
f090029ecd2264b984721ed50bf04094fcf183311b87930d1816534f4dd6da4e
2a97eefb81b0234328c6d859fdc1c1177d4850691d31162c8c5708e94a452138
7b49988a41f87260871578ac40ee21ce66a9b8fc614775875675866ff13188e6
481201152d564d542d01c316ec85431d62f6175720fe28f9ca89e6366d73c3c6
93d65be11493447f9d40d806d4e35b1bf5dfc4b0834bf20cd0e447e893894910
40a510dd9933e02e51e62b91d854aaa2612c41b4bbb999cfa5c872f3370d13b6
09d9bb25f1d1bd6f7c3e3aa64df49eaa398e9f26b198ef9b92b6c18c804f0bc1
068ae3605b91f7ef4fc55da190972bbc6286ba415d277ef49e98cbad92e7843c
ff14a00150284811bbe39c1eaf0e0fe7f11aef6c3822feea012ce62fb9d9dfb8
dc131f02d7979e9e02a35a7587bc9ac98155140f7b005892d15916893abe5cbf
ec826faf723057c91169f41ae7c1720d1f2391ac6d5f7c55075274221523f7b5
24b3d36dd1e117a17fcc7bbda20bf4e3afe69b674a9ac7cae483a3a31e9de5fa
72ba4cfd959620d844ee73b52d5094ed282344cdbbcf2762722ba79dcb86225d
b4b3e1a2ac1fc40f877c13268abdcc295f043c8bf8ce2886cf9cdab16fb81edd
c47a6d3e018fdbc0f63c224735e6ed5746bc6a70c26f7c60e9ccdcd030ac38e6
707a04a12631b78cc0b83d4218a3c2caab5a031a0352fb85c2b5c761c937b0be
6336b9fbb76277167facddac816655d079a8604f7273b2bb8dad169d1723c793
0f8b56af0b1be1247a5bf989a92eca657855d96e4b3b9eac1a109cbe8bfbd40a
0fdeafeda5401dd9a63c5d2b3297af4a0c55acb3eacd415f26b48698209c1f4a
08415e962db965deaa4e02ecf2e198942100c56b5835e9298242da837b585b69
bf53766eb860140c6914ffb3bb1fa152e709e19b04b932e16dd26c16a8008c17
2e6e8729d76dc13a750db437a1677e60d579f785714e7c5bbff65085be0f08bf
fe7a13d4f8685767fee1cba9fe64ae0ffe1ff8ef75e7bf0bacedc0bfadea65b8
beca004dfd77f218a00baeb20a2e0d26ffcb0e8c88abc1fcdec9b8b78e289255
7a0268be5fbffbe146338591959ffe772ca26a3b78bda1479db38791952aa4e2
beff5a79e3ddd5ea4bd7949b4935d3f21fb10968d0317051ba298b024cde943f
d7ce5c446babcebb082adc57a95ee0987e64f30abce2c258cf8d1469186df3d9
aae1fefb67ab509c078638b5ba82bd724a9fbe634c620c94c790e0981bbf270e
16842d889bdac3685118f3ce1e2ac6e352ade59800f46fbdd4cc60f586502feb
8fd916f77448322da50802bc0fd2ae0492932f42c742f9b996a56ec66f13d564
beb38b475d203dd46d3d1fa63ca34a83df6c45775b348279a5dc19ef1a861336
91c71931cf8c74ba9c417034c0317d8e8e71f9917aaacb11e86b532091f0caef
a27b8247b250cc81af64776356a4399d6d36ec4e3b15e484e2ebae60fbd77040
52179b6fdf543bbe889d1d67a83bba9fc25ec33da4ef630472025932d4ee3192
6014786b41622c5201cdb283d606c70831da00f1d890087b2be68fb4f5515e71
acaaedee4683ce2d097a80bc6d6815408d48b809f0df56ca653319737748dc23
76e1d32e444437378a8561d13a082d31e0fc35effeb46cc618c82a4ed98db622
2a63ec67519f9fd59f54c4ed1a6a9b82ca3e7f6e29cce42b42f41d3a68f0e64a
963325e138a79d2c9f72f61bda8601704629c526a7f707eb9cd689efab376d11
8862f70691d3e4fd9993c7bec511b4829403f15fba9b7999708edc372da0103c
0f8f4678218df508896a6e58d5d206adb8991f8cef033dfae733d5a2a12a2fe6
4911e25310acfe3efe4ed72720cdfe857a33dc6c0dbaf94120858aedae58baf4
9d23a234dbe5c77bdb7ef8c15e72dc31de7cce7a296ba4c6021fa38c860b6aa6
66db6bba6cd5a20a84720a71783077ed39830a52b6231ee42508a17805899d80
bacbbc495f8feb32cf7634b1e66c448cacb7f5f91d18e5d2682a6e903adb4744
6a7d48f08212a61d9fc4202234cd290a42fdd8eebbb53d90c57dc971a159caf3
becc55f0da56190c49c0b6043e9e7edaf68621331434f23f037f99a41d476ce0
3b27cb347865bcc539b7faad94c6ed0d383e2fec84f2ec6c5d32bfb83ba03def
950d626cdf9aa112d51ab6464231f153a8b72c7da5d2de8ffabbe86f1f356f84
4296f6d95543d642919a532ad639b2f0e1e0d004f80c1abafdfea4f02c10aee8
b99e21dce83c8184c7396d9b0fb284ce0ce662a1cc9d1ad59448000eac1bd806
b28d6b994dcacc0d94a798011c1f7f6ba7bb293e0260159b60104620f320e01c
2d4a9826902438e97fd11eac1fe05819dbc649be0e006b849336079fff0ccf18
a28b2614336ba255b5c7d33b2a7eb8b29ffedf766871c2a5be8e67270b32b0af
e98425cc4d2e9f27570c6df58a67abb8e9e05f0c84359a556958a4a67c1b3e53
d5e5f7d079b216078282d955c2d625bda28ca2a4de774a46ab571c388d897dac
d898c6a965e975401a73dc7068488e0248bc10a0794cb2600fa12bc6d63007d8
4d2921f38a5bbc12057aecb0e0a370ecf21035428fa2a8508f03023aabde3754
bbe0f79b031a4f2c83578fbe30e1f51881b2bbb1ec53051d785f1f4bbbb238c7
ee8601daf173de7abca7dbe5335a6d9511de07fa40cdec51d0a82246575a35cd
670b1670bc457d64c885cbca3aebcf462aae5086707585f610c4fedc8f4ee073
SH256 hash:
ca81d370ff7e2f2b429d2c1ff109a351f66f5bb9799d34c424aaaac684ed59a4
MD5 hash:
41cea46a44d655ab07e414f88b07260a
SHA1 hash:
6678722fb1a3889b18d7ba42ec509e1f84521dd3
Link:
https://www.unpac.me/results/cdf07480-4523-4c7f-82d8-afeeaedddb56/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ca81d370ff7e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/ca81d370ff7e2f2b429d2c1ff109a351f66f5bb9799d34c424aaaac684ed59a4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pdb_YARAify
Create hunting rule
Author:@wowabiy314
Description:PDB

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Tofsee

Executable exe ca81d370ff7e2f2b429d2c1ff109a351f66f5bb9799d34c424aaaac684ed59a4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2303568/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/312573/

Comments