A deeper look at Tofsee modules

This report provides a detailed technical analysis of the Tofsee/Gheg modular malware, enumerating 20 plugin modules and their capabilities — including credential and cookie theft, SMTP-based spam generation using a custom scripting language, SOCKS proxying, cryptocurrency mining, DDoS capabilities, USB and social-media spreading, and persistence/backdoor installation — and supplies DLL names and MD5 hashes as indicators of compromise.