Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    file.exe

  • Size

    327KB

  • Sample

    230111-jqdr3sbe64

  • MD5

    cac294181b203b7842a3cb7f088abcfc

  • SHA1

    0f29d824da088340a39e1806a718d9132bc7441b

  • SHA256

    710e157f1b500c71193bbeb23a2f6fbd492a9ad47a13256b1d058e864e0908dc

  • SHA512

    319f074816133158ced69e9db6a5a1756af61fce613d7adbe429f3ee4a3ecb113d0128a3ac13cf1b3f46dad4a7dadf4f9ffcd237a9a5fd0c22a6e34cafdb81c2

  • SSDEEP

    6144:n+HG1UJcOEexoWDNRTlGOyyDqCFH0iXlG9:ne85OBoWDNisOCysG

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Targets

    • Target

      file.exe

    • Size

      327KB

    • MD5

      cac294181b203b7842a3cb7f088abcfc

    • SHA1

      0f29d824da088340a39e1806a718d9132bc7441b

    • SHA256

      710e157f1b500c71193bbeb23a2f6fbd492a9ad47a13256b1d058e864e0908dc

    • SHA512

      319f074816133158ced69e9db6a5a1756af61fce613d7adbe429f3ee4a3ecb113d0128a3ac13cf1b3f46dad4a7dadf4f9ffcd237a9a5fd0c22a6e34cafdb81c2

    • SSDEEP

      6144:n+HG1UJcOEexoWDNRTlGOyyDqCFH0iXlG9:ne85OBoWDNisOCysG

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Windows security bypass

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

    • XMRig Miner payload

    • Creates new service(s)

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks