\nDestruction Level:<\/strong> High
\nPrevalence:<\/strong> Medium<\/p>\n
Malware Name(s)<\/strong><\/h3>\n\n- Backdoor.Win32.Tofsee (Padvish)<\/strong><\/li>\n
- A Variant Of Win32\/Tofsee.AJ (ESET)<\/strong><\/li>\n
- Backdoor:Win32\/Hostil.gen!A (Microsoft)<\/strong><\/li>\n
- HEUR:Trojan.Win32.Generic (Kaspersky)<\/strong><\/li>\n<\/ul>\n
<\/p>\n
What is Backdoor Malware?<\/h3>\n
Backdoors are applications designed to allow hackers to bypass the system security mechanism, granting unauthorized access to various system resources. Hackers can enter the system, with no concern for altered usernames or passwords, bypass authentication protocols. These applications come in various forms and hackers use them upon their needs to breach a system resource.<\/p>\n
<\/p>\n
What is Tofsee Malware?<\/h3>\n
Tofsee is a type of malware used primarily to send spam emails via SMTP messages. The content of these emails is determined by the malware server and is commonly used for promotional spam. Another significant feature of Tofsee is its ability to download and execute executable file from the server. This malware variant is often packaged with several different crypters and ultimately injects the original malware into a svchost.exe process.<\/p>\n
<\/h3>\nTechnical Description<\/h2>\nIndicators of Compromise:<\/h3>\n
\u274c Changes the HKU\\*\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\shell<\/em><\/span>\u00a0key, usually set to explorer.exe<\/span> by default, and adds the unpacked malware path at its end.<\/p>\n\u274c Creates a key in\u00a0SOFTWARE\\Microsoft\\DeviceControl\\DevData<\/em><\/span> in `HKLM<\/em>` or `HKU<\/em>` with encrypted content.<\/p>\n\u274c Presence of the following files:<\/p>\n
%WINDIR%\\Temp:temp<\/em><\/span><\/p>\nUserProfile%\\Application Data\\desktop.ini:init%<\/em><\/span><\/p>\n\u274c \u00a0If the above files cannot be created, the malware creates a file in this path:
\nUserProfile%\\Local Settings\\Application Data\\Microsoft\\Windows\\UsrClass.dat.tmp%<\/em><\/span><\/p>\n <\/p>\n
Performance Description<\/h3>\n
The malware consists of two main modules. The first\u00a0module identifies the mail server addresses:<\/p>\n
![\"\u067e\u06cc\u062f\u0627](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/06\/1-\u067e\u06cc\u062f\u0627-\u06a9\u0631\u062f\u0646-\u0622\u062f\u0631\u0633-Mail-Server-\u062f\u0627\u0645\u0646\u0647\u200c\u0647\u0627\u06cc-\u0632\u06cc\u0631.png\")
<\/p>\n
The purpose of another module is to communicate with the Command and Control (C&C) server to receive commands and settings, including\u00a0 creating a list of email addresses for spamming, email contents, and more. It can also send and execute applications on the victim’s server.<\/p>\n
This version of the malware uses the following addresses to connect to the C&C server:<\/p>\n
193[.]27[.]246[.]157 <\/em><\/span>
\n212[.]95[.]32[.]52 <\/em><\/span>
\nRgtryhbgddtyh[.]biz <\/em><\/span>
\nwertdghbyrukl[.]ch<\/em><\/span><\/p>\nIn the image below, the main functions of the malware is provided:<\/p>\n
![\"](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/06\/2-\u062a\u0648\u0627\u0628\u0639-\u0627\u0635\u0644\u06cc-\u0628\u062f\u0627\u0641\u0632\u0627\u0631-Tofsee.png\")
<\/p>\n
<\/h4>\nNetwork Connection<\/h3>\n
The malware initially attempts to find the IP addresses of mail servers such as those of Microsoft, Yahoo, etc. In another thread, it connects to its C&C server using the TCP protocol to receive and decrypt encrypted information. If the connection to the first address fails, the malware attempts to connect to other C&C addresses after 5 minutes.<\/p>\n
![\"\u0631\u0648\u0634](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2024\/06\/3-\u0631\u0648\u0634-\u0627\u0631\u062a\u0628\u0627\u0637-\u0628\u0627-\u0634\u0628\u06a9\u0647.png\")
<\/p>\n
How to deal with and clean the system<\/h2>\n
Padvish Antivirus detects and removes this malware. To prevent infection:<\/p>\n
\u2714\ufe0f\u00a0Keep your antivirus software up to date.
\n\u2714\ufe0f\u00a0Obtain files from reliable sources.
\n\u2714\ufe0f\u00a0Avoid clicking on suspicious links and scan email attachments with antivirus.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview Type: Trojan (backdoor) Destruction Level: High Prevalence: Medium Malware Name(s) Backdoor.Win32.Tofsee (Padvish) A Variant Of Win32\/Tofsee.AJ (ESET) Backdoor:Win32\/Hostil.gen!A (Microsoft) HEUR:Trojan.Win32.Generic (Kaspersky) What is Backdoor Malware? Backdoors are applications designed to allow hackers to bypass the system security mechanism, granting unauthorized access to various system resources. Hackers can enter the system, with no concern…<\/p>\n","protected":false},"author":27,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[14],"tags":[53],"class_list":["post-1581","post","type-post","status-publish","format-standard","hentry","category-backdoor","tag-backdoor"],"_links":{"self":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1581","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/comments?post=1581"}],"version-history":[{"count":3,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1581\/revisions"}],"predecessor-version":[{"id":1584,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1581\/revisions\/1584"}],"wp:attachment":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/media?parent=1581"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/categories?post=1581"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/tags?post=1581"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
<\/p>\n
What is Backdoor Malware?<\/h3>\n
Backdoors are applications designed to allow hackers to bypass the system security mechanism, granting unauthorized access to various system resources. Hackers can enter the system, with no concern for altered usernames or passwords, bypass authentication protocols. These applications come in various forms and hackers use them upon their needs to breach a system resource.<\/p>\n
<\/p>\n
What is Tofsee Malware?<\/h3>\n
Tofsee is a type of malware used primarily to send spam emails via SMTP messages. The content of these emails is determined by the malware server and is commonly used for promotional spam. Another significant feature of Tofsee is its ability to download and execute executable file from the server. This malware variant is often packaged with several different crypters and ultimately injects the original malware into a svchost.exe process.<\/p>\n
<\/h3>\nTechnical Description<\/h2>\nIndicators of Compromise:<\/h3>\n
Indicators of Compromise:<\/h3>\n
\u274c Changes the HKU\\*\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\shell<\/em><\/span>\u00a0key, usually set to explorer.exe<\/span> by default, and adds the unpacked malware path at its end.<\/p>\n \u274c Creates a key in\u00a0SOFTWARE\\Microsoft\\DeviceControl\\DevData<\/em><\/span> in `HKLM<\/em>` or `HKU<\/em>` with encrypted content.<\/p>\n \u274c Presence of the following files:<\/p>\n %WINDIR%\\Temp:temp<\/em><\/span><\/p>\n UserProfile%\\Application Data\\desktop.ini:init%<\/em><\/span><\/p>\n \u274c \u00a0If the above files cannot be created, the malware creates a file in this path: <\/p>\n The malware consists of two main modules. The first\u00a0module identifies the mail server addresses:<\/p>\n The purpose of another module is to communicate with the Command and Control (C&C) server to receive commands and settings, including\u00a0 creating a list of email addresses for spamming, email contents, and more. It can also send and execute applications on the victim’s server.<\/p>\n This version of the malware uses the following addresses to connect to the C&C server:<\/p>\n 193[.]27[.]246[.]157 <\/em><\/span> In the image below, the main functions of the malware is provided:<\/p>\n The malware initially attempts to find the IP addresses of mail servers such as those of Microsoft, Yahoo, etc. In another thread, it connects to its C&C server using the TCP protocol to receive and decrypt encrypted information. If the connection to the first address fails, the malware attempts to connect to other C&C addresses after 5 minutes.<\/p>\n Padvish Antivirus detects and removes this malware. To prevent infection:<\/p>\n \u2714\ufe0f\u00a0Keep your antivirus software up to date. Overview Type: Trojan (backdoor) Destruction Level: High Prevalence: Medium Malware Name(s) Backdoor.Win32.Tofsee (Padvish) A Variant Of Win32\/Tofsee.AJ (ESET) Backdoor:Win32\/Hostil.gen!A (Microsoft) HEUR:Trojan.Win32.Generic (Kaspersky) What is Backdoor Malware? Backdoors are applications designed to allow hackers to bypass the system security mechanism, granting unauthorized access to various system resources. Hackers can enter the system, with no concern…<\/p>\n","protected":false},"author":27,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[14],"tags":[53],"class_list":["post-1581","post","type-post","status-publish","format-standard","hentry","category-backdoor","tag-backdoor"],"_links":{"self":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1581","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/comments?post=1581"}],"version-history":[{"count":3,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1581\/revisions"}],"predecessor-version":[{"id":1584,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1581\/revisions\/1584"}],"wp:attachment":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/media?parent=1581"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/categories?post=1581"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/tags?post=1581"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\nUserProfile%\\Local Settings\\Application Data\\Microsoft\\Windows\\UsrClass.dat.tmp%<\/em><\/span><\/p>\nPerformance Description<\/h3>\n
<\/p>\n
\n212[.]95[.]32[.]52 <\/em><\/span>
\nRgtryhbgddtyh[.]biz <\/em><\/span>
\nwertdghbyrukl[.]ch<\/em><\/span><\/p>\n<\/p>\n<\/h4>\n
Network Connection<\/h3>\n
<\/p>\nHow to deal with and clean the system<\/h2>\n
\n\u2714\ufe0f\u00a0Obtain files from reliable sources.
\n\u2714\ufe0f\u00a0Avoid clicking on suspicious links and scan email attachments with antivirus.<\/p>\n","protected":false},"excerpt":{"rendered":"