Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2025-01-28_5a4d47d675308426af33bf8cbd4b2e2f_mafia

  • Size

    14.1MB

  • Sample

    250128-mr477swmgn

  • MD5

    5a4d47d675308426af33bf8cbd4b2e2f

  • SHA1

    4f0bf49757f0a0d2416e03ec3fdab61c06980a17

  • SHA256

    b57c516bc6526bc3b718001da64b5bca02fa7db74cffd8b32ebdb4acadf82938

  • SHA512

    91d73bf1b565132e6e30055b031b11148305008aad841508381939555af399ada348e9cbc63794403d0265679cee7e4fc621e90b328a0afe5a202fe7e50bc993

  • SSDEEP

    24576:rEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZo:4fotW

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Targets

    • Target

      2025-01-28_5a4d47d675308426af33bf8cbd4b2e2f_mafia

    • Size

      14.1MB

    • MD5

      5a4d47d675308426af33bf8cbd4b2e2f

    • SHA1

      4f0bf49757f0a0d2416e03ec3fdab61c06980a17

    • SHA256

      b57c516bc6526bc3b718001da64b5bca02fa7db74cffd8b32ebdb4acadf82938

    • SHA512

      91d73bf1b565132e6e30055b031b11148305008aad841508381939555af399ada348e9cbc63794403d0265679cee7e4fc621e90b328a0afe5a202fe7e50bc993

    • SSDEEP

      24576:rEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZo:4fotW

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Tofsee family

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks