Analysis Summary

Tofsee malware has been around since 2016. Once installed on a compromised computer, it can be used to send spam emails and gather user data. The malware can download more modules to carry out different activities. It can track users' online activities, steal personal information and credentials, and change browser and DNS settings. Tofsee has been known to spread through malicious email attachments, infected software downloads, and drive-by downloads from compromised websites. It can also persist on a system even after a reboot and can hide its presence from antivirus software. Upon execution, it drops multiple files onto the system and modifies the registry to ensure persistence. Tofsee uses a combination of stealth techniques to avoid detection, such as process hollowing, code obfuscation, and anti-debugging measures. This malware can cause major damage, such as financial loss and computer infections. It is used by cybercriminals to generate as much revenue as possible. The program is likely to install unintentionally, causing a slew of issues for both the system and other users. Tofsee is also capable of injecting unwanted advertisements into web pages visited by the infected user and redirecting browser traffic to malicious websites.

In terms of mitigation, it is crucial to keep software and operating systems up to date, avoid downloading suspicious files, and use a reputable antivirus program.

Impact

• Information Theft
• Credential Theft
• Crypto-Mining

Indicators of Compromise

MD5

• 6c2830c79d0a840f479ad635e3d57883
• 547d22725d299a21760e957f1522d03b
• 3bd8d73863b0dce52f4249742a249159
• 4000d4183cb34633077012e5853c52e0
• c20fa0ab6b79f5d972c8ce22fa9c52b1
• 56781772c92e1822beec9faee18fadc9
• fed1740e597fff2d18ccd42e44d3f099
• 52d6521fdf86ef42b47afa05bf06225f
• b40b6b9bd2f7d17a65c72469ee2e2cfa
• aa5d9fbf691d6f7844cdfefb7a8f82a1

SHA-256

• a5f35b4f8933e0106c7743eaadbd3b883f61552add7ff17aca237450b3aa4168
• d99e41c304f50b2548a79f43cfea1de5d96ceb38b254ed8057b59ae190916200
• df49a84d186d108fe2ec367f168cb6bb56af66bce347661e739e43c727575d67
• 881e0d77937dfe04295b394212e9004db0bbad441ed40fab38a8a48216020bf7
• 3b55d16d4573718b2bd722914b09e4096c7ca4ea6ca8c735a003988cb633bc1a
• 4f0a6b89e63437c52a7adf09a15950b3ba5b9d1d7c8791a8559721ae24875894
• 793959ab5ee6f59d49e330b808c2300772290f68bce04be397b1d02ea26833e6
• 039bcb175a6042892395691ef543d82135ff3e0542cc18a30b791d20d205b966
• f37f32eb1c859541773f55297fb1e05bbfc2874851fc7bbd4e185d3a6a1b6583
• 3c056fb4b1e0d834bf85eb5b09490be3f80fd8cbe6f4cae55a078075c3bc1d5e

SHA1

• dc4073381a79705a4df53048cad7b44679623835
• 5fc9a7b3d3b118b38d1b76f33eba59ba3f49e33e
• 6bd13906b2893c993e174ea6f9b0a1c1ac55aa0d
• 8a7816c227ebbd7ad29299f7b4caba89e32dc522
• a4684e4d865d543a2a498f034af4c9d2c1b6261a
• 889af8e28ecda1df1e79c1f4abe533959b29a9db
• 7fbf25801100278f9ddfc0a40e1cd8cd46fb0288
• ffe1dca080b60cac20e6d2dcba807388badde68f
• 859ffdfda568b34e1c3ded9f846dea6e8774f5b5
• 4927dddbc51f349f18037eb79e80f400b2829282

Remediation

• Block all threat indicators at your respective controls.
• Search for indicators of compromise (IOCs) in your environment utilizing your respective security controls.
• Emails from unknown senders should always be treated with caution.
• Never trust or open links and attachments received from unknown sources/senders.
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Enable two-factor authentication.
• Enable antivirus and anti-malware software and update signature definitions on time. Using multi-layered protection is necessary to secure vulnerable assets.