MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cbaf166d5627651d85f09b787ba9768ddd87f0615e651cd3aaf65ef8b1fb280d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Tofsee


Vendor detections: 17


Intelligence 17 IOCs YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cbaf166d5627651d85f09b787ba9768ddd87f0615e651cd3aaf65ef8b1fb280d
SHA3-384 hash: c0e26918af7935d2ec407c135618185228c9a20a1b85bdbe6cf7bf087017cd336b655a3ab82c00900385f6d8bebcf86e
SHA1 hash: d63f5189a77af3f779a5206ad7fb01324f223fc5
MD5 hash: 3445edcd62039254708461f07b2fcb31
humanhash: black-salami-enemy-muppet
File name:cbaf166d5627651d85f09b787ba9768ddd87f0615e651cd3aaf65ef8b1fb280d
Download: download sample
Signature Tofsee
Create hunting rule
File size:14'083'584 bytes
First seen:2025-04-02 14:29:08 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash fa1d4246e3b102c3e9d9affe19671d22 (1 x DanaBot, 1 x Tofsee)
ssdeep 49152:wllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll3:
Threatray 56 similar samples on MalwareBazaar
TLSH T127E67C34ABFD896AEAF307F099768AF55A3ABCC2E91C415E1414264B3D71E0C4CD136E
TrID 47.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.9% (.EXE) Win64 Executable (generic) (10522/11/4)
9.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.8% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon fcfcf4f4d4d4d8c0 (12 x RedLineStealer, 12 x RaccoonStealer, 3 x Smoke Loader)
Reporter JAMESWT_WT
Tags:exe Tofsee

Intelligence

File Origin
# of uploads :
1
# of downloads :
29
Origin country :
IT IT
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
cbaf166d5627651d85f09b787ba9768ddd87f0615e651cd3aaf65ef8b1fb280d.exe
Verdict:
Malicious activity
Analysis date:
2025-04-02 14:40:52 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/18204426-3e76-46d2-be30-7d82d16c3e44

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Tofsee
Create hunting rule
Link:
https://www.capesandbox.com/analysis/198/
Detection(s):
Win.Malware.Mikey-9917879-0
Create hunting rule

Win.Packed.Lockbit-9919158-0
Create hunting rule

Win.Dropper.Tofsee-9919472-0
Create hunting rule

Win.Dropper.Lockbit-9919572-0
Create hunting rule

Win.Malware.Stopcrypt-9933337-0
Create hunting rule

Win.Dropper.Tofsee-9934046-0
Create hunting rule

Win.Dropper.Tofsee-9934861-0
Create hunting rule

Win.Dropper.Generickdz-9935256-0
Create hunting rule

Win.Malware.Generic-9935525-0
Create hunting rule

Win.Malware.Generic-9935807-0
Create hunting rule

Win.Malware.Generic-9938009-0
Create hunting rule

Win.Packed.Pwsx-9965185-0
Create hunting rule

Win.Packed.Bandook-9965180-1
Create hunting rule

Win.Packer.pkr_ce1a-9980177-0
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67ed4bbf855e5ec5240c4b79
Tags:
phishing tofsee emotet
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% directory
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Launching a process
Creating a file
Launching the process to change the firewall settings
Creating a service
Creating a process from a recently created file
Launching a service
Launching the default Windows debugger (dwwin.exe)
Moving a file to the Windows subdirectory
Searching for synchronization primitives
Connection attempt to an infection source
Enabling autorun for a service
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Query of malicious DNS domain
Unauthorized injection to a system process
Adding exclusions to Windows Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
azorult crypt fingerprint microsoft_visual_cc overlay
Link:
https://www.filescan.io/uploads/67ed49bef274bf2d8e2e7432/reports/2d351e13-21de-43c9-a0ec-cc8ba3d99cb2/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/cbaf166d5627651d85f09b787ba9768ddd87f0615e651cd3aaf65ef8b1fb280d
Malware family:
Tofsee
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5961228d-4c4b-44f5-8db0-eaf05178ee17
Result
Threat name:
Tofsee
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1654786
Signature
Adds extensions / path to Windows Defender exclusion list (Registry)
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Deletes itself after installation
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Drops executables to the windows directory (C:\Windows) and starts them
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Modifies the windows firewall
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Suspect Svchost Activity
Sigma detected: Suspicious New Service Creation
System process connects to network (likely due to code injection or exploit)
Uses netsh to modify the Windows network and firewall settings
Writes to foreign memory regions
Yara detected Tofsee
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1654786 Sample: z0TVy5AR3c.exe Startdate: 02/04/2025 Architecture: WINDOWS Score: 100 59 patmushta.info 2->59 61 microsoft-com.mail.protection.outlook.com 2->61 69 Found malware configuration 2->69 71 Malicious sample detected (through community Yara rule) 2->71 73 Antivirus detection for URL or domain 2->73 75 10 other signatures 2->75 8 rhrtfofk.exe 2->8         started        11 z0TVy5AR3c.exe 2 2->11         started        14 svchost.exe 6 6 2->14         started        signatures3 process4 file5 77 Detected unpacking (changes PE section rights) 8->77 79 Detected unpacking (overwrites its own PE header) 8->79 81 Writes to foreign memory regions 8->81 87 2 other signatures 8->87 16 svchost.exe 1 8->16         started        20 WerFault.exe 2 8->20         started        51 C:\Users\user\AppData\Local\...\rhrtfofk.exe, PE32 11->51 dropped 83 Uses netsh to modify the Windows network and firewall settings 11->83 85 Modifies the windows firewall 11->85 22 cmd.exe 1 11->22         started        25 sc.exe 1 11->25         started        27 netsh.exe 2 11->27         started        33 4 other processes 11->33 29 WerFault.exe 2 14->29         started        31 WerFault.exe 2 14->31         started        signatures6 process7 dnsIp8 53 52.101.42.0, 25, 49745, 49747 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 16->53 55 patmushta.info 104.131.68.180, 443, 49725, 49727 DIGITALOCEAN-ASNUS United States 16->55 57 microsoft-com.mail.protection.outlook.com 52.101.8.49, 25, 49723, 49729 MICROSOFT-CORP-MSN-AS-BLOCKUS United States 16->57 63 System process connects to network (likely due to code injection or exploit) 16->63 65 Deletes itself after installation 16->65 67 Adds extensions / path to Windows Defender exclusion list (Registry) 16->67 49 C:\Windows\SysWOW64\...\rhrtfofk.exe (copy), PE32 22->49 dropped 35 conhost.exe 22->35         started        37 conhost.exe 25->37         started        39 conhost.exe 25->39         started        41 conhost.exe 27->41         started        43 conhost.exe 33->43         started        45 conhost.exe 33->45         started        47 conhost.exe 33->47         started        file9 signatures10 process11
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/cbaf166d5627651d85f09b787ba9768ddd87f0615e651cd3aaf65ef8b1fb280d
Detection:
tofsee
Create hunting rule
Link:
https://mwdb.cert.pl/sample/cbaf166d5627651d85f09b787ba9768ddd87f0615e651cd3aaf65ef8b1fb280d/
Threat name:
Win32.Ransomware.StopCrypt
Create hunting rule
Status:
Malicious
First seen:
2022-02-09 03:18:02 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
31 of 36 (86.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zoxrm3kwe5sr3bpqtn4hxklwrxoyp4dblzsrzu5k6zpprmp3fagq._file
Verdict:
malicious
Label(s):
tofsee
Create hunting rule
shellcode_loader_002
Create hunting rule
Similar samples:
00ea7604f15f2e8669b46970802b58f738b45e16e16572b404847d9eed5e0750
Tofsee
3fbcf2c933319cf24163ff269de32f931f2fc2614212dd28dc9e48d1c07e73dc
Tofsee
79767847a6ce916ffc23081831dd82b423ab7a2375c7e259e0938bf1272b4f47
Tofsee
c9210e5069031d55b571815950ad69a0f3534121882667bc65a8e02c29124e5f
Tofsee
d62abd683105757b72ad6b2293fab03a0ca02f8bfb5a4a9525e8e2356b66231f
Tofsee
error
Tofsee
+ 46 additional samples on MalwareBazaar
Result
Malware family:
tofsee
Create hunting rule
Score:
  10/10
Tags:
family:tofsee defense_evasion discovery execution persistence privilege_escalation trojan
Link:
https://tria.ge/reports/250402-rvbghs1ky2/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Event Triggered Execution: Netsh Helper DLL
Program crash
System Location Discovery: System Language Discovery
Launches sc.exe
Suspicious use of SetThreadContext
Checks computer location settings
Deletes itself
Executes dropped EXE
Creates new service(s)
Modifies Windows Firewall
Sets service image path in registry
Tofsee
Tofsee family
Malware Config
C2 Extraction:
patmushta.info
parubey.info
Verdict:
Malicious
Tags:
Win.Malware.Mikey-9917879-0
YARA:
n/a
Link:
https://app.threat.zone/submission/1f23e009-86f9-495b-b19d-99826f60c6e4
Unpacked files
SH256 hash:
cbaf166d5627651d85f09b787ba9768ddd87f0615e651cd3aaf65ef8b1fb280d
MD5 hash:
3445edcd62039254708461f07b2fcb31
SHA1 hash:
d63f5189a77af3f779a5206ad7fb01324f223fc5
Link:
https://www.unpac.me/results/8d96c9dc-21f9-40c0-83b1-d6335fb91b5d/
SH256 hash:
9523920c59da070b3b2f21a933d24cddcad1bbaeb3b732804038d4450903e77d
MD5 hash:
f1aa631204fa2aab6347b5720a170748
SHA1 hash:
6b36050e65661f6a897286d5101b2a30b1ad6075
Detections:
win_tofsee_w0
Create hunting rule
Tofsee
Create hunting rule
Detect_Tofsee
Create hunting rule
MALWARE_Win_Tofsee
Create hunting rule
MALWARE_Win_Grum
Create hunting rule
Link:
https://www.unpac.me/results/8d96c9dc-21f9-40c0-83b1-d6335fb91b5d/
Parent samples :
d35dd18698186ad6694cfb0361dd9e0c30c03ca1935c40cac4e92e672bec1080
925c11560a88096bc28480d802d69da132ff883236e0d8dfaf9a367fa07cc245
e142b01c4b04ddca2ffded33fa5e8e3accf2b305021efd57b485cb06f072e84e
3a1e3377c664b6863dda1d7d7ae9c353defc585a6df6eeb1c5147f21d31faaaf
ee87fd0a4b66479135cb2342baaa9fbf54e7dfa4ea65a13a35661a8a2f144663
2c63bf7e8c39671b903cb389c3ec23b73065f338d817bdd3ef3cc89028b5dd4d
a9416f3272c3accd4215cbcbd8af56b6fabe9b05a0ef552e5004edb272ea8abf
0f9a3e60242422bf0a29a4429f7c4321cb98efe0bc61cdba8efc0bc59993fa12
b6e2a4cce6a336b3331f7514ae550ed23690bc5184531e80b33560fda52e0a5a
cbaf166d5627651d85f09b787ba9768ddd87f0615e651cd3aaf65ef8b1fb280d
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cbaf166d5627/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cbaf166d5627651d85f09b787ba9768ddd87f0615e651cd3aaf65ef8b1fb280d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_Tofsee
Create hunting rule
Author:@malgamy12
Description:Detect_Tofsee
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MALWARE_Win_Grum
Create hunting rule
Author:ditekSHen
Description:Detect Grum spam bot
Rule name:MALWARE_Win_Tofsee
Create hunting rule
Author:ditekSHen
Description:Detects Tofsee
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:tofsee_yhub
Create hunting rule
Author:Billy Austin
Description:Detects Tofsee botnet, also known as Gheg
Rule name:Windows_Trojan_Generic_2993e5a5
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Tofsee_26124fe4
Create hunting rule
Author:Elastic Security
Rule name:win_tofsee_bot
Create hunting rule
Author:akrasuski1
Description:Tofsee malware
Rule name:win_tofsee_w0
Create hunting rule
Author:akrasuski1

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/198/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetStartupInfoW
KERNEL32.dll::GetStartupInfoA
KERNEL32.dll::GetCommandLineW
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::WriteConsoleInputW
KERNEL32.dll::WriteConsoleW
KERNEL32.dll::WriteConsoleA
KERNEL32.dll::ReadConsoleW
KERNEL32.dll::ReadConsoleInputA
KERNEL32.dll::SetConsoleTitleW
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileW
KERNEL32.dll::CreateFileA
KERNEL32.dll::GetFileAttributesW
WIN_BASE_USER_APIRetrieves Account InformationKERNEL32.dll::DnsHostnameToComputerNameW

Comments