Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    05d7c671aacc749256eb4bff4bf6ba15

  • Size

    10.1MB

  • Sample

    231225-fcp2eahfek

  • MD5

    05d7c671aacc749256eb4bff4bf6ba15

  • SHA1

    12b5be47bc40d49fed97a0ecbc61879c6527e3f7

  • SHA256

    75065fb333a2af48312ad3db7cd379895965031f095be5220b22b732ffd8783a

  • SHA512

    65952f6443c5972a86f8fbc714c2641f30871ddf29a3c2fe905eeb324aa46273c74889eecdb8b64b37336313c5df4ed4f421993d47f9e5938bb06018dc6b4ac2

  • SSDEEP

    98304:QNWUlllllllllllllllllllllllllllllllllllllllllllllllllllllllllllT:GW

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Targets

    • Target

      05d7c671aacc749256eb4bff4bf6ba15

    • Size

      10.1MB

    • MD5

      05d7c671aacc749256eb4bff4bf6ba15

    • SHA1

      12b5be47bc40d49fed97a0ecbc61879c6527e3f7

    • SHA256

      75065fb333a2af48312ad3db7cd379895965031f095be5220b22b732ffd8783a

    • SHA512

      65952f6443c5972a86f8fbc714c2641f30871ddf29a3c2fe905eeb324aa46273c74889eecdb8b64b37336313c5df4ed4f421993d47f9e5938bb06018dc6b4ac2

    • SSDEEP

      98304:QNWUlllllllllllllllllllllllllllllllllllllllllllllllllllllllllllT:GW

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks