SYMBOLCOMMON_NAMEaka. SYNONYMS
win.tofsee (Back to overview)

Tofsee

aka: Gheg
VTCollection     URLhaus    

According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.

Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.

References
2023-10-12SpamhausSpamhaus Malware Labs
Spamhaus Botnet Threat Update Q3 2023
FluBot AsyncRAT Ave Maria Cobalt Strike DCRat Havoc IcedID ISFB Nanocore RAT NjRAT QakBot Quasar RAT RecordBreaker RedLine Stealer Remcos Rhadamanthys Sliver Stealc Tofsee Vidar
2023-07-11SpamhausSpamhaus Malware Labs
Spamhaus Botnet Threat Update Q2 2023
Hydra AsyncRAT Aurora Stealer Ave Maria BumbleBee Cobalt Strike DCRat Havoc IcedID ISFB NjRAT QakBot Quasar RAT RecordBreaker RedLine Stealer Remcos Rhadamanthys Sliver Tofsee
2023-04-12SpamhausSpamhaus Malware Labs
Spamhaus Botnet Threat Update Q1 2023
FluBot Amadey AsyncRAT Aurora Ave Maria BumbleBee Cobalt Strike DCRat Emotet IcedID ISFB NjRAT QakBot RecordBreaker RedLine Stealer Remcos Rhadamanthys Sliver Tofsee Vidar
2023-04-10Check PointCheck Point
March 2023’s Most Wanted Malware: New Emotet Campaign Bypasses Microsoft Blocks to Distribute Malicious OneNote Files
Agent Tesla CloudEyE Emotet Formbook Nanocore RAT NjRAT QakBot Remcos Tofsee
2023-04-06SpamhausRaashid Bhat
Neutralizing Tofsee Spambot – Part 1 | Binary file vaccine
Tofsee
2023-04-06SpamhausRaashid Bhat
Neutralizing Tofsee Spambot – Part 2 | InMemoryConfig store vaccine
Tofsee
2023-04-06SpamhausRaashid Bhat
Neutralizing Tofsee Spambot – Part 3 | Network-based kill switch
Tofsee
2023-03-28BitSightAndré Tavares
Tofsee Botnet: Proxying and Mining
Tofsee
2022-11-21Github (larsborn)Lars Wallenborn
Tofsee String Decryption Code
Tofsee
2022-10-13SpamhausSpamhaus Malware Labs
Spamhaus Botnet Threat Update Q3 2022
FluBot Arkei Stealer AsyncRAT Ave Maria BumbleBee Cobalt Strike DCRat Dridex Emotet Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT QakBot RecordBreaker RedLine Stealer Remcos Socelars Tofsee Vjw0rm
2022-02-11Cisco TalosTalos
Threat Roundup for February 4 to February 11
DarkComet Ghost RAT Loki Password Stealer (PWS) Tinba Tofsee Zeus
2022-02-08Intel 471Intel 471
PrivateLoader: The first step in many malware schemes
Dridex Kronos LockBit Nanocore RAT NjRAT PrivateLoader Quasar RAT RedLine Stealer Remcos SmokeLoader STOP Tofsee TrickBot Vidar
2021-05-17DragosKent Backman
Investigating the Watering Hole Linked to the Oldsmar Water Treatment Facility Breach
Tofsee
2017-10-19CERT.PLJarosław Jedynak
A deeper look at Tofsee modules
Tofsee
2017-10-06CERT.PLJarosław Jedynak, Maciej Kotowicz
Peering into spam botnets
Emotet Kelihos Necurs SendSafe Tofsee
2017-03-24Zerophage
Terror EK via Malvertising delivers Tofsee Spambot
Tofsee
2016-12-22GovCERT.chGovCERT.ch
Tofsee Spambot features .ch DGA - Reversal and Countermesaures
Tofsee
2016-09-29Cisco TalosEdmund Brumaghin
Want Tofsee My Pictures? A Botnet Gets Aggressive
Tofsee
2016-09-16CERT.PLAdam Krasuski
Tofsee – modular spambot
Tofsee
2014-04-02Virus BulletinRyan Mi
Tofsee botnet
Tofsee
2009-03-17Marshal8e6Rodel Mendrez
Gheg spambot
Tofsee
Yara Rules
[TLP:WHITE] win_tofsee_auto (20230808 | Detects win.tofsee.)
rule win_tofsee_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.tofsee."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8d8584feffff 50 68b7000000 68a9000000 6a0c 68???????? 68???????? }
            // n = 7, score = 400
            //   8d8584feffff         | lea                 eax, [ebp - 0x17c]
            //   50                   | push                eax
            //   68b7000000           | push                0xb7
            //   68a9000000           | push                0xa9
            //   6a0c                 | push                0xc
            //   68????????           |                     
            //   68????????           |                     

        $sequence_1 = { f7f3 8b450c 8a0402 88043e 46 3b7508 7ce0 }
            // n = 7, score = 400
            //   f7f3                 | div                 ebx
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   8a0402               | mov                 al, byte ptr [edx + eax]
            //   88043e               | mov                 byte ptr [esi + edi], al
            //   46                   | inc                 esi
            //   3b7508               | cmp                 esi, dword ptr [ebp + 8]
            //   7ce0                 | jl                  0xffffffe2

        $sequence_2 = { f7fb 80c261 881431 49 47 85c9 }
            // n = 6, score = 400
            //   f7fb                 | idiv                ebx
            //   80c261               | add                 dl, 0x61
            //   881431               | mov                 byte ptr [ecx + esi], dl
            //   49                   | dec                 ecx
            //   47                   | inc                 edi
            //   85c9                 | test                ecx, ecx

        $sequence_3 = { bf???????? 8b46fc 48 744d 48 743a }
            // n = 6, score = 400
            //   bf????????           |                     
            //   8b46fc               | mov                 eax, dword ptr [esi - 4]
            //   48                   | dec                 eax
            //   744d                 | je                  0x4f
            //   48                   | dec                 eax
            //   743a                 | je                  0x3c

        $sequence_4 = { 5e 5b c9 c3 56 57 ff15???????? }
            // n = 7, score = 400
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx
            //   c9                   | leave               
            //   c3                   | ret                 
            //   56                   | push                esi
            //   57                   | push                edi
            //   ff15????????         |                     

        $sequence_5 = { 33c0 eb3a 8b4b3c 03cb 813950450000 75ef }
            // n = 6, score = 400
            //   33c0                 | xor                 eax, eax
            //   eb3a                 | jmp                 0x3c
            //   8b4b3c               | mov                 ecx, dword ptr [ebx + 0x3c]
            //   03cb                 | add                 ecx, ebx
            //   813950450000         | cmp                 dword ptr [ecx], 0x4550
            //   75ef                 | jne                 0xfffffff1

        $sequence_6 = { 0f8ee8f7ffff 5b 8b4570 83c004 50 ff15???????? ff7564 }
            // n = 7, score = 400
            //   0f8ee8f7ffff         | jle                 0xfffff7ee
            //   5b                   | pop                 ebx
            //   8b4570               | mov                 eax, dword ptr [ebp + 0x70]
            //   83c004               | add                 eax, 4
            //   50                   | push                eax
            //   ff15????????         |                     
            //   ff7564               | push                dword ptr [ebp + 0x64]

        $sequence_7 = { 8b4038 40 57 8bcb 8945fc e8???????? 8bc8 }
            // n = 7, score = 400
            //   8b4038               | mov                 eax, dword ptr [eax + 0x38]
            //   40                   | inc                 eax
            //   57                   | push                edi
            //   8bcb                 | mov                 ecx, ebx
            //   8945fc               | mov                 dword ptr [ebp - 4], eax
            //   e8????????           |                     
            //   8bc8                 | mov                 ecx, eax

        $sequence_8 = { 55 56 57 8bf1 ffd3 8b3d???????? 8be8 }
            // n = 7, score = 400
            //   55                   | push                ebp
            //   56                   | push                esi
            //   57                   | push                edi
            //   8bf1                 | mov                 esi, ecx
            //   ffd3                 | call                ebx
            //   8b3d????????         |                     
            //   8be8                 | mov                 ebp, eax

        $sequence_9 = { c0e105 0ad9 32da 34c6 881e 46 3bf7 }
            // n = 7, score = 400
            //   c0e105               | shl                 cl, 5
            //   0ad9                 | or                  bl, cl
            //   32da                 | xor                 bl, dl
            //   34c6                 | xor                 al, 0xc6
            //   881e                 | mov                 byte ptr [esi], bl
            //   46                   | inc                 esi
            //   3bf7                 | cmp                 esi, edi

    condition:
        7 of them and filesize < 147456
}
[TLP:WHITE] win_tofsee_w0   (20171121 | No description)
rule win_tofsee_w0 {
    meta:
        author="akrasuski1"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tofsee"
        malpedia_version = "20171121"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:

        $decryptStr = {32 55 14 88 10 8A D1 02 55 18 F6 D9 00 55 14}
        $xorGreet = {C1 EB 03 C0 E1 05 0A D9 32 DA 34 C6 88 1E}
        $xorCrypt = {F7 FB 8A 44 0A 04 30 06 FF 41 0C}

        $string_res1 = "loader_id"
        $string_res2 = "born_date"
        $string_res3 = "work_srv"
        $string_res4 = "flags_upd"
        $string_res5 = "lid_file_upd"
        $string_res6 = "localcfg"

        $string_var0 = "%RND_NUM"
        $string_var1 = "%SYS_JR"
        $string_var2 = "%SYS_N"
        $string_var3 = "%SYS_RN"
        $string_var4 = "%RND_SPACE"
        $string_var5 = "%RND_DIGIT"
        $string_var6 = "%RND_HEX"
        $string_var7 = "%RND_hex"
        $string_var8 = "%RND_char"
        $string_var9 = "%RND_CHAR"

    condition:
        (7 of ($string_var*) and 4 of ($string_res*))
        or
        (7 of ($string_var*) and 2 of ($decryptStr, $xorGreet, $xorCrypt))
        or
        (4 of ($string_res*) and 2 of ($decryptStr, $xorGreet, $xorCrypt))
}
Download all Yara Rules