Loading malware…
Tofsee, also known as Gheg, is a long-running modular Windows malware family primarily associated with mass spam and botnet operations. Reported capabilities include operating as a spambot, botnet/backdoor activity, cryptocurrency mining, theft of login and email credentials, and downloading additional malware, including ransomware or banking trojans. It has also been described as plugin-based and written in C/C++.
The malware is reported to be delivered through loaders or spearphishing email, and has also been propagated via PrivateLoader. After execution, Tofsee copies itself into SysWOW64 or an equivalent directory and into a temporary folder, typically using different filenames. It establishes persistence by creating a Windows service via sc.exe, often using benign networking-related names or descriptions such as "wifi support." It modifies Windows Firewall rules with netsh.exe, including adding permissive rules for svchost.exe, adds its dropped path to registry exclusions, and injects into svchost.exe to conceal activity. The injected svchost.exe instance is then used for backdoor functionality and command-and-control communications. The malware is also reported to use code obfuscation, packing, and anti-analysis techniques.
Tofsee stores chained configuration data on infected hosts for reuse after reboot. Reported storage locations include %USERPROFILE%:.repos, %USERPROFILE%\Local Settings:.repos, %USERPROFILE%\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.repos, %USERPROFILE%\wincookie.repos, and the registry keys HKEY_CURRENT_USER\Control Panel\Buses\Config0 and HKEY_CURRENT_USER\SOFTWARE\Microsoft\Buses\Config0. Stored configuration data is XOR-encoded. The work_srv and start_srv structures are specifically noted as being retrieved during the initial C2 connection.
The malware has been used in mass campaigns and the provided content states it is not associated with a specific threat actor. It has been referenced in relation to botnet activity dropping follow-on payloads, and was noted as resurging in 2025. Dragos also described a newer Tofsee botnet variant it called "Tesseract," associated with the user-agent artifact "Tesseract/1.0" and JA3 hashes 5732cd1c2c85c7548ef840e05f42feec, 45728c30345dddda40cd01ee2f7a4c8e, and 9f681ac5cde4d035b5d3dc040bda1a34. In that reporting, darkteam.store was assessed as a possible check-in location for infected systems.
High-confidence indicators mentioned in the content include the domains svartalfheim.top and lazystax.ru; IP addresses 31.41.244.126, 31.41.244.127, 31.41.244.128, 43.231.4.7, 46.173.223.212, 98.136.96.76, and 111.121.193.242; and sample SHA-256 hashes 9ff3eb5bac86aef0116488ac380f9d7ea15d27f9d580462fcf3612293525f50f, 2f5b289a8dcb26ed9389a49687e513f162ed3145469a5cb90f0aab45c699c3d9, 22179b5cece54e42dbc249c5112994e0e760c2435f3547579d04d19882b79b03, 3c38e00f572800dfdcf676a141e4b98903977368f8870cd29221b3320b640ed4, 6ce6c04ffb7f0ac158c0e340b52d2ebdb48fd089bd24c6fdbf81947bce0e476d, and 2701f35430167bbb99f334c81088af75f8209a07cb1bcbf9c765a4968af2fbaa.
The content also describes a vulnerability in Tofsee itself: improper length validation during CRC32 processing of ResourceStructure packet data in update_config_resource can cause an out-of-bounds read and crash the malware when parsing an InmemoryConfig structure.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
15 distinct techniques documented for this family, organized by ATT&CK tactic.
While all the above processes are being launched, we have the other binary in a temporary path performing other actions, such as injecting an svchost... Once in this phase, you have the Tofsee functionalities inside a legitimate process
For the creation of the service, we can see that it creates with own start a service “Wifi Support”, as we had commented before, usually it is habitual that it is related to something of the network, trying to avoid to be found.
The config stores of particular interest to us are the work_srv and start_srv structures. Both are retrieved during the initial C&C connection of the Tofsee botnet.
46 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Botnet referenced as part of the commodity malware pipeline and observed dropping follow-up payloads.
Botnet used to originate/distribute spam emails in the described campaigns; historically propagated via the PrivateLoader loader.
An older malware family known for spamming and botnet activities, experiencing a resurgence in 2025.
Tofsee stores chained configuration data in multiple file and registry locations on infected systems, encodes it with a simple XOR algorithm, and retrieves key configuration structures during its initial command-and-control connection.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.