Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    file

  • Size

    293KB

  • Sample

    231012-25t2qagc64

  • MD5

    b4da9897cf577c55aa364a57ce6d6ab6

  • SHA1

    8d2c6b7c0496be939c94db11c1deed3761aa36b1

  • SHA256

    dc1bc9d08ef773a4d935b0051c240ef1b9f2ce8dcc000063ffdcab1ef6bd1d50

  • SHA512

    57e0754e00f7e70a21bf6c2a062fe7b76c422b530b62236455689540f2c1ffb22caac3e936cb4f6616db7558a9b2a81a70103d11449c7ac5bb70c9cb38887d02

  • SSDEEP

    3072:mlNvrtDJVoihS660sTdgmfJFXNQ25xSA2SXux02PiaJxas/aT:E5oihS660shgmfLN/50yXuL/a

Malware Config

Extracted

Family

tofsee

C2

vanaheim.cn

jotunheim.name

Targets

    • Target

      file

    • Size

      293KB

    • MD5

      b4da9897cf577c55aa364a57ce6d6ab6

    • SHA1

      8d2c6b7c0496be939c94db11c1deed3761aa36b1

    • SHA256

      dc1bc9d08ef773a4d935b0051c240ef1b9f2ce8dcc000063ffdcab1ef6bd1d50

    • SHA512

      57e0754e00f7e70a21bf6c2a062fe7b76c422b530b62236455689540f2c1ffb22caac3e936cb4f6616db7558a9b2a81a70103d11449c7ac5bb70c9cb38887d02

    • SSDEEP

      3072:mlNvrtDJVoihS660sTdgmfJFXNQ25xSA2SXux02PiaJxas/aT:E5oihS660shgmfLN/50yXuL/a

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.