Behavioral task
behavioral1
Sample
3528-157-0x0000000000400000-0x0000000000594000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
3528-157-0x0000000000400000-0x0000000000594000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
3528-157-0x0000000000400000-0x0000000000594000-memory.dmp
-
Size
1.6MB
-
MD5
36402325dcebe15d2905dcac854c65dc
-
SHA1
d6d992797cea3b618ed1e6f5ebebdeaffa6468a3
-
SHA256
12edc30620db5b23c098ea117a08bd2aaebc688aadc619c8484d5dded0736a73
-
SHA512
191db6d7304e917685d5c0f3e703fd26b5c057a51a802423ece045c155e8f9bf9fe8e261739cfb6da46f37b27cc4e1685bd9da40283bbc399b69a6b2cf167efb
-
SSDEEP
6144:6PVCneO+XFfpIuHh0/SsLpmF0yI5NS4CDdmutyYL:u8p6FfpZG/Rp20E/46L
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Signatures
-
Tofsee family
Files
-
3528-157-0x0000000000400000-0x0000000000594000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ