Behavioral task
behavioral1
Sample
2452-166-0x0000000000400000-0x0000000002C2E000-memory.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
2452-166-0x0000000000400000-0x0000000002C2E000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
2452-166-0x0000000000400000-0x0000000002C2E000-memory.dmp
-
Size
40.2MB
-
MD5
93a0d5013db6d7897f68f580acb51a9d
-
SHA1
a9e10c8831a90a98d1aee19e6d24935aa99818e0
-
SHA256
bc0f9a144a0b28fa7548673d0303e2ab58f24de51f01762adfdac1693776c039
-
SHA512
d527b92ef5b9c72acb939085109cc2e37209edd249ae9ca79eec6955a5425c183146eded82396f840f4723a5ea7ae6d37e3bd6afb16922fa2733b2aed893859c
-
SSDEEP
3072:6PVCnQxSYO+XFapIbVl5ti4K2Gq8w76zPyMPic9Xs5Sv/u+k+MfEGVM/h3m:6PVCneO+XFapIpFfGqLkqo9XssS5
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Signatures
-
Tofsee family
Files
-
2452-166-0x0000000000400000-0x0000000002C2E000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ