Overview

overview

7

Static

static

7

Tokky-NTEv0.3.1.zip

windows10-2004-x64

1

Tokky-NTEv0.3.1.zip

windows11-ltsc_2024-x64

1

global/NTE...al.dll

windows10-2004-x64

7

global/NTE...al.dll

windows11-ltsc_2024-x64

7

global/langs/en.json

windows10-2004-x64

3

global/langs/en.json

windows11-ltsc_2024-x64

3

global/launcher.exe

windows10-2004-x64

6

global/launcher.exe

windows11-ltsc_2024-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    Tokky-NTEv0.3.1.zip
  • Size 11.0MB
  • Sample260721-jgblcsbv7z
  • SHA256 ebfa7bbe5c8fa472c0ef07cf7ccdc17bee5ed21044f667d544c2231c3f75bbe9
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionvmprotect

Malware Config

Targets

    • Target
      Tokky-NTEv0.3.1.zip
    • Size 11.0MB
    • SHA256 ebfa7bbe5c8fa472c0ef07cf7ccdc17bee5ed21044f667d544c2231c3f75bbe9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      global/NTE-internal.dll
    • Size 5.7MB
    • SHA256 2639ed63634cf1bb60d531d82810293f634b399da9cd111b672a0b26d5f04255
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    vmprotect

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral3behavioral4
    • Target
      global/langs/en.json
    • Size 2KB
    • SHA256 1f2174b08f30e2f348a3119b6bdc20748fc13c6be194ba6c951af6e4cb3d0961
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral5behavioral6
    • Target
      global/launcher.exe
    • Size 257KB
    • SHA256 97b36886adc328cf4de434b1eb7bd9ee5c683b5a7b9213f57531113483c475f3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    discovery

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral7behavioral8

MITRE ATT&CK Enterprise v16

Tasks