Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2025-02-02_c56e610b43d2ac76ad7dc92cd7e03569_mafia

  • Size

    12.1MB

  • Sample

    250202-bklxhazrdp

  • MD5

    c56e610b43d2ac76ad7dc92cd7e03569

  • SHA1

    10a16546d945bef65213f13862d795681736d3b4

  • SHA256

    f08b557d3233ff20b89f3ad91b1ea99bba0847df5964b87bd2735216b1236aa3

  • SHA512

    01977a1a9a25dffd1ca122dd984182faf5dde8ac4a79b14bf9d6ef13046f6154e52d0d7b8ce058675be3e5d4d62235f6fef7ce9ea5e6c5dfc3656e3a96a0950d

  • SSDEEP

    24576:fEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZN:cfot

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Targets

    • Target

      2025-02-02_c56e610b43d2ac76ad7dc92cd7e03569_mafia

    • Size

      12.1MB

    • MD5

      c56e610b43d2ac76ad7dc92cd7e03569

    • SHA1

      10a16546d945bef65213f13862d795681736d3b4

    • SHA256

      f08b557d3233ff20b89f3ad91b1ea99bba0847df5964b87bd2735216b1236aa3

    • SHA512

      01977a1a9a25dffd1ca122dd984182faf5dde8ac4a79b14bf9d6ef13046f6154e52d0d7b8ce058675be3e5d4d62235f6fef7ce9ea5e6c5dfc3656e3a96a0950d

    • SSDEEP

      24576:fEfmTNIkv/ZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZN:cfot

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Tofsee family

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks