tofsee | ae30f8849f76c8517dbb9922a570efd8b2a502292df7f768bfdeebab92aa52ba

Sharing

Copy URL

Twitter E-mail

General

Target

ae30f8849f76c8517dbb9922a570efd8b2a502292df7f768bfdeebab92aa52ba
Size

71KB
MD5

26ebbf2fff571c90b3af42785d65db3a
SHA1

20ddf85b7a5d92dd7e41fd22237556460f56e98b
SHA256

ae30f8849f76c8517dbb9922a570efd8b2a502292df7f768bfdeebab92aa52ba
SHA512

71b444041b967a33a89cf6c31090e86045f5f683dc577d1eae2696cbdae569e70a061968c1f9ba36d9515be14e2369020c74a2ea2ed2798a77778dfc06c050d9
SSDEEP

1536:Dkes21VCy1nTxSYg3CXTjFWL9SdpIHUc:DDVCyFxSYACXF/pI0

Score

10^/10

tofsee

Malware Config

Extracted

Family

tofsee

vanaheim.cn

jotunheim.name

Signatures

Tofsee family
tofsee

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ae30f8849f76c8517dbb9922a570efd8b2a502292df7f768bfdeebab92aa52ba

Files

ae30f8849f76c8517dbb9922a570efd8b2a502292df7f768bfdeebab92aa52ba
.exe windows:5 windows x86 arch:x86

0bdef4d92a94790d7d279561a490c5bb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

ws2_32

ioctlsocket
__WSAFDIsSet
WSAStartup
send
connect
setsockopt
bind
listen
accept
getsockname
htonl
gethostname
socket
select
recv
ntohs
htons
sendto
gethostbyaddr
inet_ntoa
gethostbyname
inet_addr
getpeername
closesocket

dbghelp

StackWalk64

kernel32

GetVolumeInformationA
GetComputerNameA
GetTickCount
GetCurrentProcess
GetModuleHandleA
GetSystemInfo
GetVersionExA
lstrcmpiA
lstrlenA
Sleep
lstrcpynA
InterlockedExchange
GetCurrentThreadId
ExitProcess
GetOverlappedResult
WaitForSingleObject
GetLastError
WriteFile
ReadFile
CreateFileA
DisconnectNamedPipe
ConnectNamedPipe
CreateNamedPipeA
CloseHandle
LoadLibraryA
GetEnvironmentVariableA
DeleteFileA
IsBadWritePtr
IsBadCodePtr
lstrcpyA
lstrcmpA
VirtualProtect
IsBadReadPtr
VirtualFree
WriteProcessMemory
VirtualAllocEx
VirtualAlloc
SetFilePointer
GetFileSize
SetFileAttributesA
GetDiskFreeSpaceA
GetWindowsDirectoryA
GetProcAddress
LocalFree
GetFileAttributesExA
LocalAlloc
CreateProcessA
GetTempPathA
SystemTimeToFileTime
GetSystemTime
DeviceIoControl
CreateFileW
GetModuleFileNameA
ResumeThread
SetThreadContext
TerminateProcess
GetThreadContext
lstrcatA
CreateThread
GetDriveTypeA
GetCommandLineA
SetUnhandledExceptionFilter
SetErrorMode
InterlockedIncrement
GetLocalTime
GetTimeZoneInformation
FileTimeToLocalFileTime
FileTimeToSystemTime
InterlockedDecrement
HeapSize
GetSystemTimeAsFileTime
MultiByteToWideChar
lstrlenW
GetStartupInfoW
GetProcessHeap
HeapAlloc
HeapReAlloc
HeapFree
FreeLibrary
CreateEventA
GetSystemDirectoryA

user32

wsprintfA
CharToOemA

advapi32

ConvertSidToStringSidA
AllocateAndInitializeSid
CreateProcessWithLogonW
RegCreateKeyExA
StartServiceCtrlDispatcherA
RegisterServiceCtrlHandlerA
SetServiceStatus
RegDeleteValueA
RegGetKeySecurity
RegSetKeySecurity
RegSetValueExA
GetLengthSid
GetFileSecurityA
GetSecurityDescriptorOwner
EqualSid
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
SetFileSecurityA
GetSecurityDescriptorDacl
GetAce
DeleteAce
SetSecurityDescriptorDacl
RegQueryValueExA
RegEnumKeyA
RegOpenKeyExA
RegEnumValueA
GetUserNameW
LookupAccountNameW
LookupAccountNameA
GetUserNameA
RegCloseKey
CheckTokenMembership
FreeSid

shell32

ShellExecuteA
ShellExecuteExW

oleaut32

SysAllocStringByteLen

Sections

.text
Size: 57KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

Files

0bdef4d92a94790d7d279561a490c5bb

Headers

DLL Characteristics

File Characteristics

Imports

ws2_32

dbghelp

kernel32

user32

advapi32

shell32

oleaut32

Sections

.text Size: 57KB - Virtual size: 60KB

.rdata Size: 8KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 8KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 57KB - Virtual size: 60KB

.rdata
Size: 8KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 8KB

.reloc
Size: 4KB - Virtual size: 3KB