Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    file.exe

  • Size

    260KB

  • Sample

    221029-j4z78sgge9

  • MD5

    257eb857f8bb4557e98acdc30f209b66

  • SHA1

    f6e57354bea528c4db7c1096e53f8c5c6b94273d

  • SHA256

    ec9baf02d53da35618afb04be30f976c97fcca173712fa2acfefe979e598cb9a

  • SHA512

    8d0615a278e9124f6a66ec2a2a75d3bed26fa61bfaece95d7bc9a14fb27adafd2825e26c3b9e558d158e986d795823b1e7784e047c6b3d48fca348dd2a9b5e0e

  • SSDEEP

    6144:sSFBiHLLktQEkXoaB8oLYzW7tJHuDLeGW:tBygtQEktB8hq7/HuvjW

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Targets

    • Target

      file.exe

    • Size

      260KB

    • MD5

      257eb857f8bb4557e98acdc30f209b66

    • SHA1

      f6e57354bea528c4db7c1096e53f8c5c6b94273d

    • SHA256

      ec9baf02d53da35618afb04be30f976c97fcca173712fa2acfefe979e598cb9a

    • SHA512

      8d0615a278e9124f6a66ec2a2a75d3bed26fa61bfaece95d7bc9a14fb27adafd2825e26c3b9e558d158e986d795823b1e7784e047c6b3d48fca348dd2a9b5e0e

    • SSDEEP

      6144:sSFBiHLLktQEkXoaB8oLYzW7tJHuDLeGW:tBygtQEktB8hq7/HuvjW

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Windows security bypass

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Creates new service(s)

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Deletes itself

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks