TofseeMalware
- gheg
According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.From MISP Galaxy
Last reported 3 years ago, by Group-IB1 report
ATT&CK techniques
6 of 44 · each with the sentence it comes from- T1005Data from Local System
“T1005 Data from Local System”
- T1007System Service Discovery
“T1007 System Service Discovery”
- T1012Query Registry
“T1012 Query Registry”
- T1014Rootkit
“T1014 Rootkit”
- T1020Automated Exfiltration
“T1020 Automated Exfiltration”
- T1027Obfuscated Files or Information
“T1027 Obfuscated Files or Information”
What the reports say
1 report, newest first · the exact sentence from each-
Package deal: Malware bundles causing disruption and damage across EMEA“…e, since mid-July, RedLine has increasingly been combined with miners, keyloggers, and a Trojan that recruits compromised systems to the Tofsee spam botnet.”
Indicators in its reports
named in the reports above- hxxps://digitalfitsoft[.]comin 1 report
- digitalfitsoft[.]comin 1 report
- hxxps://installmentloan7vrt[.]orgin 1 report
- installmentloan7vrt[.]orgin 1 report
- soft-you[.]comin 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.