Tofsee

Tofsee, also known as Gheg, is a long-running modular Windows malware family primarily associated with mass spam and botnet operations. Reported capabilities include operating as a spambot, botnet/backdoor activity, cryptocurrency mining, theft of login and email credentials, and downloading additional malware, including ransomware or banking trojans. It has also been described as plugin-based and written in C/C++.

The malware is reported to be delivered through loaders or spearphishing email, and has also been propagated via PrivateLoader. After execution, Tofsee copies itself into SysWOW64 or an equivalent directory and into a temporary folder, typically using different filenames. It establishes persistence by creating a Windows service via sc.exe, often using benign networking-related names or descriptions such as "wifi support." It modifies Windows Firewall rules with netsh.exe, including adding permissive rules for svchost.exe, adds its dropped path to registry exclusions, and injects into svchost.exe to conceal activity. The injected svchost.exe instance is then used for backdoor functionality and command-and-control communications. The malware is also reported to use code obfuscation, packing, and anti-analysis techniques.

Tofsee stores chained configuration data on infected hosts for reuse after reboot. Reported storage locations include %USERPROFILE%:.repos, %USERPROFILE%\Local Settings:.repos, %USERPROFILE%\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.repos, %USERPROFILE%\wincookie.repos, and the registry keys HKEY_CURRENT_USER\Control Panel\Buses\Config0 and HKEY_CURRENT_USER\SOFTWARE\Microsoft\Buses\Config0. Stored configuration data is XOR-encoded. The work_srv and start_srv structures are specifically noted as being retrieved during the initial C2 connection.

The malware has been used in mass campaigns and the provided content states it is not associated with a specific threat actor. It has been referenced in relation to botnet activity dropping follow-on payloads, and was noted as resurging in 2025. Dragos also described a newer Tofsee botnet variant it called "Tesseract," associated with the user-agent artifact "Tesseract/1.0" and JA3 hashes 5732cd1c2c85c7548ef840e05f42feec, 45728c30345dddda40cd01ee2f7a4c8e, and 9f681ac5cde4d035b5d3dc040bda1a34. In that reporting, darkteam.store was assessed as a possible check-in location for infected systems.

High-confidence indicators mentioned in the content include the domains svartalfheim.top and lazystax.ru; IP addresses 31.41.244.126, 31.41.244.127, 31.41.244.128, 43.231.4.7, 46.173.223.212, 98.136.96.76, and 111.121.193.242; and sample SHA-256 hashes 9ff3eb5bac86aef0116488ac380f9d7ea15d27f9d580462fcf3612293525f50f, 2f5b289a8dcb26ed9389a49687e513f162ed3145469a5cb90f0aab45c699c3d9, 22179b5cece54e42dbc249c5112994e0e760c2435f3547579d04d19882b79b03, 3c38e00f572800dfdcf676a141e4b98903977368f8870cd29221b3320b640ed4, 6ce6c04ffb7f0ac158c0e340b52d2ebdb48fd089bd24c6fdbf81947bce0e476d, and 2701f35430167bbb99f334c81088af75f8209a07cb1bcbf9c765a4968af2fbaa.

The content also describes a vulnerability in Tofsee itself: improper length validation during CRC32 processing of ResourceStructure packet data in update_config_resource can cause an out-of-bounds read and crash the malware when parsing an InmemoryConfig structure.