Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    5864ab38a798ad82f56c489fc9250508

  • Size

    10.8MB

  • Sample

    231226-gqzy7sebf9

  • MD5

    5864ab38a798ad82f56c489fc9250508

  • SHA1

    36654bbcd99a23208bd05849094cce2660d49b85

  • SHA256

    64ebbff5b114f374a5ea408f1970dad3b57de201a00eab43eacf0c6637984698

  • SHA512

    9aaa11aee25e1a4cb06c2ee32970c33476f27ad1729e76404d252a8453d8de870eec90dc00fafe7b35646467be31a3e0a4686b4a2c93dcc938d1d3a80ba479a4

  • SSDEEP

    49152:wRBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB/:

Malware Config

Extracted

Family

tofsee

C2

43.231.4.6

lazystax.ru

Targets

    • Target

      5864ab38a798ad82f56c489fc9250508

    • Size

      10.8MB

    • MD5

      5864ab38a798ad82f56c489fc9250508

    • SHA1

      36654bbcd99a23208bd05849094cce2660d49b85

    • SHA256

      64ebbff5b114f374a5ea408f1970dad3b57de201a00eab43eacf0c6637984698

    • SHA512

      9aaa11aee25e1a4cb06c2ee32970c33476f27ad1729e76404d252a8453d8de870eec90dc00fafe7b35646467be31a3e0a4686b4a2c93dcc938d1d3a80ba479a4

    • SSDEEP

      49152:wRBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB/:

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks