Tofsee

Tofsee, also known as Gheg, is a modular C/C++ malware family primarily associated with spam botnet operations. High-confidence reporting in the provided content states that it is designed to send spam email and also supports broader botnet activity including cryptocurrency mining, theft of login and email credentials, and downloading additional malware, commonly ransomware or banking trojans. The malware uses techniques to evade detection and maintain persistence on infected Windows systems.

The content describes Tofsee as storing chained configuration data locally so it can survive reboots. Reported storage locations include %USERPROFILE%:.repos, %USERPROFILE%\Local Settings:.repos, %USERPROFILE%\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.repos, %USERPROFILE%\wincookie.repos, and the registry keys HKEY_CURRENT_USER\Control Panel\Buses\Config0 and HKEY_CURRENT_USER\SOFTWARE\Microsoft\Buses\Config0. Stored configuration data is encoded with a simple XOR algorithm. The work_srv and start_srv configuration structures are specifically noted as important because they are retrieved during the initial command-and-control connection.

The malware has been referenced as a plugin-based spambot and as a botnet that has dropped follow-on payloads. One cited report notes that Tofsee has previously been propagated via the C++-based loader PrivateLoader. Another report links Tofsee to spam-delivery activity in campaigns distributing Strela Stealer, where Tofsee was used as a botnet-origin source for spam while separate infrastructure hosted the first-stage malware.

The content also describes a newer Tofsee botnet variant tracked by Dragos as “Tesseract.” Dragos assessed that darkteam.store may have functioned as a check-in location for infected systems, and observed 12,735 likely Tofsee-infected IPs using 271 unique user agents to access a non-public page on that site with a user-agent containing the artifact “Tesseract/1.0.” Dragos identified three JA3 hashes attributed to this variant: 5732cd1c2c85c7548ef840e05f42feec, 45728c30345dddda40cd01ee2f7a4c8e, and 9f681ac5cde4d035b5d3dc040bda1a34. The same reporting states that some JA3 hashes associated with this botnet overlap with legitimate browser JA3 hashes. Dragos also provided two SHA-256 hashes labeled as Tofsee botnet malware: 6ce6c04ffb7f0ac158c0e340b52d2ebdb48fd089bd24c6fdbf81947bce0e476d and 2701f35430167bbb99f334c81088af75f8209a07cb1bcbf9c765a4968af2fbaa.

A vulnerability described in the content affects Tofsee itself: improper length validation during CRC32 processing of packet data. A crafted ResourceStructure packet with a manipulated 4-byte len field can cause an out-of-bounds read when update_config_resource passes data for CRC32 calculation during InmemoryConfig parsing, potentially crashing the malware process.