Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2025-02-02_21aa80f7c0de8d455dd905294073ea40_mafia

  • Size

    10.7MB

  • Sample

    250202-p9vslasnfs

  • MD5

    21aa80f7c0de8d455dd905294073ea40

  • SHA1

    a1e2df714121b93f0d36d492564276ec78e2b5fe

  • SHA256

    7ddae85a7f3628c9ac2fb4b57b97789395902111a902d5db117897420037dcbb

  • SHA512

    f0731e6f00cb55ce4ae9d5f6aa0605cf0d99e63fed1ee021bda4f22176d0645189eaba3406e4a2a92449ce7d50ecb0b769683f6fee557e4e5f2679de76ea7aa8

  • SSDEEP

    196608:jyXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXs:OXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX8

Malware Config

Extracted

Family

tofsee

C2

43.231.4.7

lazystax.ru

Targets

    • Target

      2025-02-02_21aa80f7c0de8d455dd905294073ea40_mafia

    • Size

      10.7MB

    • MD5

      21aa80f7c0de8d455dd905294073ea40

    • SHA1

      a1e2df714121b93f0d36d492564276ec78e2b5fe

    • SHA256

      7ddae85a7f3628c9ac2fb4b57b97789395902111a902d5db117897420037dcbb

    • SHA512

      f0731e6f00cb55ce4ae9d5f6aa0605cf0d99e63fed1ee021bda4f22176d0645189eaba3406e4a2a92449ce7d50ecb0b769683f6fee557e4e5f2679de76ea7aa8

    • SSDEEP

      196608:jyXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXs:OXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX8

    • Tofsee

      Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    • Tofsee family

    • Windows security bypass

    • Creates new service(s)

    • Modifies Windows Firewall

    • Sets service image path in registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks