Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    696b2374ef2ff5564406f1722f31758fb7b6bd30c3e046b628ab8126a7d06c8e

  • Size

    12.0MB

  • Sample

    231114-xsmpnaec92

  • MD5

    8caceb5caa0779ebb2c9767a1e0d5e80

  • SHA1

    385e4b0570b66ef9ba8001f3224693cc0bfd1d54

  • SHA256

    696b2374ef2ff5564406f1722f31758fb7b6bd30c3e046b628ab8126a7d06c8e

  • SHA512

    a7d0064e08ffe1a73e772c04ee5121100f339ff7e8acbd39c497d18fabcbbed362dd41691f69f1898a171a04bcb2e5565fbb979f4ffb500b94e9bda53d1d77f8

  • SSDEEP

    1536:IXKMn8zcQzaBCAXdEWp2xcR+R9ARBYNDW72RS1qziipd1f55iDV9V:ov0KTd3p2xcgrA4NS6jzTjyh9

Malware Config

Extracted

Family

tofsee

C2

103.248.137.133

59.188.74.26

115.230.124.76

111.121.193.242

Targets

    • Target

      696b2374ef2ff5564406f1722f31758fb7b6bd30c3e046b628ab8126a7d06c8e

    • Size

      12.0MB

    • MD5

      8caceb5caa0779ebb2c9767a1e0d5e80

    • SHA1

      385e4b0570b66ef9ba8001f3224693cc0bfd1d54

    • SHA256

      696b2374ef2ff5564406f1722f31758fb7b6bd30c3e046b628ab8126a7d06c8e

    • SHA512

      a7d0064e08ffe1a73e772c04ee5121100f339ff7e8acbd39c497d18fabcbbed362dd41691f69f1898a171a04bcb2e5565fbb979f4ffb500b94e9bda53d1d77f8

    • SSDEEP

      1536:IXKMn8zcQzaBCAXdEWp2xcR+R9ARBYNDW72RS1qziipd1f55iDV9V:ov0KTd3p2xcgrA4NS6jzTjyh9

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks