Backdoor:Win32/Tofsee.F

Installation

This threat copies itself to these folders using a randomly generated file name:

• %USERPROFILE%
• <system folder>

For example:

• %USERPROFILE% \srmrqc.exe
• <system folder> \yulb.exe

It deletes its original file once it's run, so you might not be able to find its file in your PC.

Tofsee makes several changes to the registry to ensure that its copies run at each Windows start:

In subkey: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Sets value: "<random entry name>"
With data: "<system folder>\<random file name>.exe \u"

In subkey: HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Sets value: "Userinit"
With data: "<system folder>\userinit.exe, %USERPROFILE%\<random file name>.exe \s"

Payload

Changes Internet Explorer security settings

Tofsee changes the following registry values to lower or disable Internet Explorer's security settings:

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Sets values:
"WarnOnZoneCrossing"
"3WarnOnPostRedirect"
"WarnonBadCertRecving"
With data: "0"

In subkey: HKCU\Software\Microsoft\Internet Explorer\IntelliForms
Sets values:
"AskUser"
"WarnOnPost"
With data: "0"

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2
Sets values:
"MinLevel"
"RecommendedLevel"
"1601"
"1803"
"1800"
"1609"
"1407"
"1406"
"1405"
"1402"
"1400"
"1201"
"1200"
"1004"
"1001"
With data: "0"

In subkey: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3
Sets value: "1601"
With data: "0"

In subkey: HKCU\Software\Microsoft\Internet Explorer\InformationBar
Sets value: "FirstTime"
With data: "0"

Tofsee also adds itself as a 'trusted program' to the Windows Firewall.

Give a malicious hacker access to your PC

Tofsee's primary purpose is to act as a spam and traffic relay. It functions as an HTTP proxy, receiving commands from a hacker that let it to generate and send emails as if they came from your PC (though not necessarily your email address).

Analysis by Matt McCormack