Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    JaffaCakes118_2563eeeeb403a1d81108b0c58af5d56a6189b14130e81bde97dfc8115c5c04c0

  • Size

    333KB

  • Sample

    241226-v8hdrssren

  • MD5

    0d81591c91af26ef156bb2303634dc1c

  • SHA1

    75fe41b23cd10e46789557d7291bb3d5a41f5d06

  • SHA256

    2563eeeeb403a1d81108b0c58af5d56a6189b14130e81bde97dfc8115c5c04c0

  • SHA512

    0bd8277d5f6d3a348d280122a089cda996936023ff7e9fd849cb684ddd3403c9ed90e6431d15be608207f5f590a49653b350423811d74d98a5aa0d7a6bbcae71

  • SSDEEP

    6144:xo2WWlmy0uqXGcQnZrwdVi0prOJLZZ5e6719ZIe:+2WWlmnRQnZrwdVi0hcLZZxpDIe

Malware Config

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Targets

    • Target

      JaffaCakes118_2563eeeeb403a1d81108b0c58af5d56a6189b14130e81bde97dfc8115c5c04c0

    • Size

      333KB

    • MD5

      0d81591c91af26ef156bb2303634dc1c

    • SHA1

      75fe41b23cd10e46789557d7291bb3d5a41f5d06

    • SHA256

      2563eeeeb403a1d81108b0c58af5d56a6189b14130e81bde97dfc8115c5c04c0

    • SHA512

      0bd8277d5f6d3a348d280122a089cda996936023ff7e9fd849cb684ddd3403c9ed90e6431d15be608207f5f590a49653b350423811d74d98a5aa0d7a6bbcae71

    • SSDEEP

      6144:xo2WWlmy0uqXGcQnZrwdVi0prOJLZZ5e6719ZIe:+2WWlmnRQnZrwdVi0hcLZZxpDIe

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Tofsee family

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks