Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    0af220cda97fd59612ef2fd9d66807a0

  • Size

    11.5MB

  • Sample

    231219-mrq1kseecp

  • MD5

    0af220cda97fd59612ef2fd9d66807a0

  • SHA1

    43701d2d5005e29bece43c006569925ee418f21a

  • SHA256

    19882daeac9da32308cd3340417db32d07bad3b023c78da4eacca0b948d17827

  • SHA512

    da9648742532a61e07177423c3423c6de6494ed1db2e045e8f76b3886c5a6207fee7576f643eca6b559ff2c78a5e3f401961afb0782b88de40cb842332dfb629

  • SSDEEP

    49152:FVwj1RzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzT:bM1

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Targets

    • Target

      0af220cda97fd59612ef2fd9d66807a0

    • Size

      11.5MB

    • MD5

      0af220cda97fd59612ef2fd9d66807a0

    • SHA1

      43701d2d5005e29bece43c006569925ee418f21a

    • SHA256

      19882daeac9da32308cd3340417db32d07bad3b023c78da4eacca0b948d17827

    • SHA512

      da9648742532a61e07177423c3423c6de6494ed1db2e045e8f76b3886c5a6207fee7576f643eca6b559ff2c78a5e3f401961afb0782b88de40cb842332dfb629

    • SSDEEP

      49152:FVwj1RzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzzT:bM1

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks