Backdoor

About “Backdoor:Win32/Tofsee.BC!MTB” infection

Malware Removal

The Backdoor:Win32/Tofsee.BC!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Backdoor:Win32/Tofsee.BC!MTB virus can do?

  • Executable code extraction
  • Creates RWX memory
  • A process created a hidden window
  • Drops a binary and executes it
  • Unconventionial language used in binary resources: Spanish (Paraguay)
  • The binary likely contains encrypted or compressed data.
  • Uses Windows utilities for basic functionality
  • Deletes its original binary from disk
  • Network activity contains more than one unique useragent.
  • Attempts to modify proxy settings
  • Creates a copy of itself
  • Anomalous binary characteristics
  • Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz
a.tomx.xyz
youtube4kdowloader.club
youtube4kprod.xyz
iplogger.org

How to determine Backdoor:Win32/Tofsee.BC!MTB?


File Info:

crc32: DD5A6D08
md5: 6111a365f4ed8edc04d4be0e4d096da1
name: s2.exe
sha1: 6178e9b51a2ac9d009afb333f4e7664f9eb08132
sha256: 1978f3bb2ae39f2e373712aaa893c4da5d0eb53820de47a5c63c8924b73400c8
sha512: c11bb5748a6de8ee318dfc79a586f8f4d357474be4a05a40db7355ce272a35730778167864565ebff387f36e84b95fafb0a593818d5862daab21c63a5edc7860
ssdeep: 6144:mAnmNw2YKn9G/5+1pzahRBlyGampgWgINCUQ6Pv:mISwpX/5UzmRKDpUQ6Pv
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

FileVersionNew: 2.3.4
InternalServiceName: speedy.exe
Copyright: Copyright (C) 2020, softtail
ProgramVersion: 1.4.7

Backdoor:Win32/Tofsee.BC!MTB also known as:

BkavW32.AIDetectVM.malware
MicroWorld-eScanTrojan.GenericKD.42880314
FireEyeGeneric.mg.6111a365f4ed8edc
McAfeeArtemis!6111A365F4ED
MalwarebytesTrojan.MalPack.GS
SangforMalware
K7AntiVirusRiskware ( 0040eff71 )
BitDefenderTrojan.GenericKD.42880314
K7GWRiskware ( 0040eff71 )
Cybereasonmalicious.51a2ac
Invinceaheuristic
BitDefenderThetaGen:NN.ZexaF.34104.pqW@aKtrEKM
CyrenW32/Trojan.JCOW-7650
APEXMalicious
Paloaltogeneric.ml
KasperskyTrojan.Win32.Chapak.ekcy
AlibabaBackdoor:Win32/Chapak.60e7683e
AegisLabRiskware.Win32.Malicious.1!c
TencentWin32.Trojan.Chapak.Wkll
Ad-AwareTrojan.GenericKD.42880314
TrendMicroTROJ_GEN.R002C0DCO20
McAfee-GW-EditionBehavesLike.Win32.Generic.dc
Trapminemalicious.moderate.ml.score
SophosMal/RyPack-A
IkarusTrojan.Win32.Crypt
GDataTrojan.GenericKD.42880314
JiangminBackdoor.Tofsee.brg
WebrootW32.Malware.Gen
AviraTR/AD.Chapak.aastj
Antiy-AVLTrojan/Win32.Wacatac
MicrosoftBackdoor:Win32/Tofsee.BC!MTB
Endgamemalicious (high confidence)
ArcabitTrojan.Generic.D28E4D3A
ZoneAlarmTrojan.Win32.Chapak.ekcy
AhnLab-V3Trojan/Win32.MalPe.R329527
Acronissuspicious
ALYacTrojan.GenericKD.42880314
ESET-NOD32a variant of Win32/Kryptik.HCEE
TrendMicro-HouseCallTROJ_GEN.R002C0DCO20
RisingTrojan.Kryptik!8.8 (CLOUD)
SentinelOneDFI – Malicious PE
FortinetW32/Kryptik.A!tr
PandaTrj/GdSda.A
CrowdStrikewin/malicious_confidence_100% (W)
Qihoo-360Win32/Trojan.bcf

How to remove Backdoor:Win32/Tofsee.BC!MTB?

Backdoor:Win32/Tofsee.BC!MTB removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment