Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    JaffaCakes118_32cbda26c9835c1c63f2fed688fb5bb9

  • Size

    10.6MB

  • Sample

    241231-yg72wsylhk

  • MD5

    32cbda26c9835c1c63f2fed688fb5bb9

  • SHA1

    1b8b5445b2ff31e5377c0a2297672bf656695777

  • SHA256

    d26320c9bf38d0c8da62667729d9c28c8c9a71bb1395bf33dff11b59cda8f6c4

  • SHA512

    34246c7b622d4ff88c401d25da883962dfba46c878bf9387f3b72942add8ccfe1785b4c5dfbacfcbbc1a3f40e866cc701ce2ff8f2334868ae16b150e61de4e5e

  • SSDEEP

    12288:KQeoegEG/Rl1M7jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjz:KQeGX1M

Malware Config

Extracted

Family

tofsee

C2

defeatwax.ru

refabyd.info

Targets

    • Target

      JaffaCakes118_32cbda26c9835c1c63f2fed688fb5bb9

    • Size

      10.6MB

    • MD5

      32cbda26c9835c1c63f2fed688fb5bb9

    • SHA1

      1b8b5445b2ff31e5377c0a2297672bf656695777

    • SHA256

      d26320c9bf38d0c8da62667729d9c28c8c9a71bb1395bf33dff11b59cda8f6c4

    • SHA512

      34246c7b622d4ff88c401d25da883962dfba46c878bf9387f3b72942add8ccfe1785b4c5dfbacfcbbc1a3f40e866cc701ce2ff8f2334868ae16b150e61de4e5e

    • SSDEEP

      12288:KQeoegEG/Rl1M7jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjz:KQeGX1M

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Tofsee family

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks