Behavioral task
behavioral1
Sample
2040-59-0x0000000000400000-0x0000000000467000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2040-59-0x0000000000400000-0x0000000000467000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
2040-59-0x0000000000400000-0x0000000000467000-memory.dmp
-
Size
412KB
-
MD5
f2ca97c9f0786ab31ad1433ba6832197
-
SHA1
a0049a8f369ff056779e71a5fc84f7d7e35ce458
-
SHA256
f38586c5d37797927dcf1b5aefaae8991446d3b41ef9cce66d6810b332e26254
-
SHA512
cd6fdc2622a75aa2cba53323dadcf1d0b182063295d53ec5f25ad1ffd4a0c91c77611a4921ff617525a56d6559a052b5e820e7211fc9744e2716c13dab8b6231
-
SSDEEP
3072:6PVCnQxSYO+XFTpIno/j/KCL2cXLFHKPc9sxA76ov3XpCYoMRKT:6PVCneO+XFTpIo7X/Ruk6oh
Malware Config
Extracted
tofsee
svartalfheim.top
jotunheim.name
Signatures
-
Tofsee family
Files
-
2040-59-0x0000000000400000-0x0000000000467000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 57KB - Virtual size: 57KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ