TONEDEAF
- First seen
- 2019-05-01 00:00:00
- Malware type
- backdoor
- Family
- Malware family
- Profile updated
- 2026-07-07 13:22:15
Targeted industries: government-and-public-sector technology-and-telecommunications
Context
TONEDEAF is a backdoor that communicates with Command and Control servers using HTTP or DNS. Supported commands include system information collection, file upload, file download, and arbitrary shell command execution. When executed, this variant of TONEDEAF wrote encrypted data to two temporary files – temp.txt and temp2.txt – within the same directory of its execution.
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Tonedeaf_Auto (yara-rule)
Reports & references
- research.checkpoint.com — Irans Apt34 Returns With An Updated Arsenal (report)
- Mandiant — Hard Pass Declining Apt34 Invite To Join Their Professional Network (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Tonedeaf (report)
- intezer.com — Blog New Iranian Campaign Tailored To Us Companies Uses Updated Toolset (report)