Tovek-V2.7-windows-x86_64.zip
- SHA256 e3642933f3f2c7ed4255fae87580f0b5281fff2ec0f27c7653a180d69ef3770f
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Tovek-V2.7-windows-x86_64/luau-lifter.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
1 signatures
300 seconds
Behavioral task
behavioral2
Sample
Tovek-V2.7-windows-x86_64/luau-lifter.exe
Resource
win11-20260911-en
windows11-21h2-x64
1 signatures
300 seconds
Behavioral task
behavioral3
Sample
Tovek-V2.7-windows-x86_64/web-server.exe
Resource
win10ltsc2021-20260911-en
windows10-ltsc_2021-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
Tovek-V2.7-windows-x86_64/web-server.exe
Resource
win11-20260911-en
windows11-21h2-x64
0 signatures
300 seconds
General
- Target Tovek-V2.7-windows-x86_64.zip
- Size 7.7MB
- Sample261102-2fkrraxtdx
- SHA256 e3642933f3f2c7ed4255fae87580f0b5281fff2ec0f27c7653a180d69ef3770f
- MD5 00e681477cc027f1c586db848ac4bb88
- SHA1 970f7ef14c26d3771f801fe1f56a8e9b98b629e1
- SHA512 434ec92895044ea5aaca50cffc16b1d00c1f991d0faae507b906f0762130039d5a3bf42098edf8b91b109c06a75deb0e4c1f14d93670c370809447b9c7f5d7fe
- SSDEEP 196608:knupFYmZJtsj2BCDOp263Iy0dXzJ1Pa9v5ChxObBL22mN7kWoW:YunYGJt42BqOA6RoXzHWGdZNYG
- TLSH T1938633CFB4B45893BD31D01B205CC578A50EB49DBE89BB4A0CC8259FDC2E3A3C659693
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Tovek-V2.7-windows-x86_64/luau-lifter.exe unpack001/Tovek-V2.7-windows-x86_64/web-server.exe
File Explorer
-
Tovek-V2.7-windows-x86_64.zip.zip 7.7MB
-
Tovek-V2.7-windows-x86_64/LICENSE.txt1KB
-
Tovek-V2.7-windows-x86_64/luau-lifter.exe.exe 10.7MB
-
Tovek-V2.7-windows-x86_64/web-server.exe.exe 9.5MB
Tovek-V2.7-windows-x86_64/LICENSE.txt
- SHA256 d4b5fdbba82c029a6a843484061bda8eece52c67e57489bf83be0cc1286edf5f
- MD5 02a698beb9f5ffe7d562168c82810948
- SHA1 a305e654ff000d48ab84dcc18c902d05ee23d16d
- SHA512 687bd8cc2f7c0aab1e4c0a9fd0541d29607183a1eb5656b6f80527503eb7776a6e1077f4c6c61c1db5de79ce50179f55de12cc31fbdd65eb317bca2fd1b32b25
- TLSH T12911B62F72990367289217A01569ECC5F13BB14A7FAB1580342DF20A132641CC9FFC64
- MD5 SHA1 SHA512 TLSH
Tovek-V2.7-windows-x86_64/luau-lifter.exe
- IMPHASH 5f875e3999b70324cd8f0fbe01d769fb
- SHA256 c964a5cb43bb94dbdc0daea574856cc3d944a5cbaecd63c8f7ba1f8a9a8d910a
- MD5 a68b1f59d4b381e418e157ee9b541213
- SHA1 d81878cd117a75cd82932f76bb7f75f886d6defe
- SHA512 6d33854b95f5ec8aa3445547c2f327000dc393439f94828c2dffddda3bb4122124b835c0f0ab6cb74cbc67c2d4bdacc88eb089ea91cb3a0d213868b47c300c5e
- SSDEEP 98304:yEIXwtjxCafkY1RQgvJlJspydC3KMbtuXH9fol1ILCDTTLgA:kOjfjHXJeKfp
- TLSH T185B63A157A5F68ACD15AC870834A8A631A2134DB1B36BCFF40D492352FAEFB05B3D719
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
8805148
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
luau_lifter.pdb
ntdll
NtSetInformationFile
RtlUnwindEx
NtOpenFile
NtCreateNamedPipeFile
NtReadFile
NtWriteFile
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
NtCreateFile
RtlNtStatusToDosError
RtlPcToFileHeader
kernel32
FindNextFileW
WriteFile
InitializeSRWLock
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetProcessTimes
TlsAlloc
TlsSetValue
TlsFree
DeleteFileW
GetCurrentProcessorNumber
FreeLibrary
GetExitCodeProcess
WaitForMultipleObjects
WriteConsoleA
SetFileInformationByHandle
DuplicateHandle
GetFileAttributesW
GetModuleHandleA
GetProcAddress
CreateProcessW
GetLastError
GetWindowsDirectoryW
GetSystemDirectoryW
ReadFile
GetOverlappedResult
CancelIo
CreateEventW
ExitProcess
CreateDirectoryW
GetFileInformationByHandle
FindFirstFileExW
SetFileTime
CreateThread
ReadFileEx
WriteFileEx
SleepEx
IsThreadAFiber
FlsSetValue
FlsFree
FlsAlloc
WriteConsoleW
GetConsoleOutputCP
ReleaseMutex
CreateMutexA
GetCurrentProcess
WaitForSingleObjectEx
GetCurrentThreadId
SwitchToThread
Sleep
CloseHandle
FindClose
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetSystemTimeAsFileTime
TlsGetValue
FlsGetValue
SetStdHandle
GetFileSizeEx
SetFilePointerEx
GetSystemInfo
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
SetConsoleMode
GetConsoleMode
GetStdHandle
GetCurrentThread
SetThreadStackGuarantee
GetFinalPathNameByHandleW
CreateFileW
GetCurrentProcessId
LockFileEx
GetFullPathNameW
SetLastError
FlushFileBuffers
GetFileInformationByHandleEx
GetSystemTimePreciseAsFileTime
WaitForSingleObject
GetFileType
GetStringTypeW
SetEnvironmentVariableW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
HeapSize
LCMapStringW
CompareStringW
AddVectoredExceptionHandler
GetCommandLineA
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
GetEnvironmentStringsW
RaiseException
InitializeCriticalSectionEx
InitializeSListHead
IsDebuggerPresent
SetUnhandledExceptionFilter
FreeEnvironmentStringsW
UnhandledExceptionFilter
LoadLibraryA
GetModuleHandleExA
VirtualQuery
VirtualFree
VirtualProtect
VirtualAlloc
GetEnvironmentVariableA
GetCommandLineW
GetModuleFileNameW
CompareStringOrdinal
QueryPerformanceCounter
FormatMessageW
QueryPerformanceFrequency
GetEnvironmentVariableW
HeapFree
HeapAlloc
HeapReAlloc
GetProcessHeap
GetModuleHandleW
GetModuleHandleExW
MultiByteToWideChar
GetCurrentDirectoryW
WideCharToMultiByte
lstrlenW
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
bcryptprimitives
ProcessPrng
Name
.text
Size
8.8MB
Virtual Size
8.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
34KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
290KB
Virtual Size
289KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=146, id=261, version=33145,
count=27, id=260, version=33145,
count=11, id=259, version=33145,
count=9, id=259, version=35207,
count=16, id=260, version=35207,
count=54, id=261, version=35207,
count=1, id=261, version=35229,
count=5, id=257, version=33145,
count=180, id=1, productName=Unmarked objects,
count=15, productName=Unmarked objects (old),
count=1, id=258, version=35229,
Tovek-V2.7-windows-x86_64/web-server.exe
- IMPHASH 47f7a8720736acb848f7976b72b13a7e
- SHA256 5e8e090766aeee227cc9579a1d086d825955e23a606795eeb58bab15c1990990
- MD5 edc66d9c59fb2d8d45b18fa378819e96
- SHA1 8595fb295b6d85b05c58b7197ce8a913244f64e3
- SHA512 191dca9068adb3360f9c02e465ef18367177f4e3b166f862550e8782a61713ab731898e05d05a46941055f3d892c53bd351dba19354406618dee4dd4f419950c
- SSDEEP 98304:2kzbQAYzT1CDXZ//ftUc7jWpVBuUyXns84fld0gh+o+L92g/SEva46W5:/gzhctLPREIL0g/SEv
- TLSH T1F9A63A157A5B68BCD15AC87083468A631A2134DB1B36BCFF41D882352FAEFB05B3D719
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
7671068
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
web_server.pdb
kernel32
CloseHandle
Sleep
GetCurrentProcessorNumber
GetConsoleScreenBufferInfo
WriteConsoleA
FreeLibrary
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock
WriteFile
GetModuleHandleA
GetProcAddress
TlsFree
SwitchToThread
PostQueuedCompletionStatus
GetSystemInfo
TlsSetValue
CreateThread
SetHandleInformation
GetSystemTimePreciseAsFileTime
SetThreadStackGuarantee
IsThreadAFiber
FlsSetValue
FlsFree
FlsAlloc
WriteConsoleW
WaitForSingleObject
GetCurrentThread
GetConsoleOutputCP
GetConsoleMode
GetStdHandle
ReleaseMutex
TlsAlloc
TerminateProcess
IsProcessorFeaturePresent
GetStartupInfoW
GetSystemTimeAsFileTime
TlsGetValue
ExitProcess
FlsGetValue
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
SetStdHandle
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
CreateFileW
CreateMutexA
GetCurrentProcessId
WaitForSingleObjectEx
GetCurrentProcess
GetCurrentThreadId
GetProcessTimes
GetFinalPathNameByHandleW
SetLastError
SetFileCompletionNotificationModes
CreateIoCompletionPort
GetQueuedCompletionStatusEx
GetLastError
GetModuleHandleExW
HeapSize
GetStringTypeW
SetEnvironmentVariableW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
LCMapStringW
CompareStringW
GetCommandLineW
GetCommandLineA
GetModuleFileNameW
LoadLibraryExW
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeCriticalSectionEx
InitializeSListHead
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetModuleHandleExA
VirtualQuery
VirtualFree
VirtualProtect
VirtualAlloc
GetEnvironmentVariableA
QueryPerformanceCounter
FormatMessageW
QueryPerformanceFrequency
GetEnvironmentVariableW
HeapFree
HeapAlloc
HeapReAlloc
GetProcessHeap
GetModuleHandleW
MultiByteToWideChar
WideCharToMultiByte
RtlVirtualUnwind
lstrlenW
LoadLibraryA
RtlLookupFunctionEntry
RtlCaptureContext
GetCurrentDirectoryW
AddVectoredExceptionHandler
FreeEnvironmentStringsW
GetEnvironmentStringsW
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
WakeByAddressAll
WaitOnAddress
ws2_32
getaddrinfo
freeaddrinfo
setsockopt
WSAGetLastError
WSACleanup
listen
bind
ioctlsocket
WSASocketW
getsockname
recv
closesocket
send
WSAStartup
shutdown
WSASend
accept
WSAIoctl
ntdll
NtCancelIoFileEx
NtCreateFile
NtWriteFile
RtlNtStatusToDosError
NtDeviceIoControlFile
advapi32
LookupPrivilegeValueA
OpenProcessToken
AdjustTokenPrivileges
bcryptprimitives
ProcessPrng
Name
.text
Size
7.7MB
Virtual Size
7.7MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
35KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
273KB
Virtual Size
272KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=146, id=261, version=33145,
count=27, id=260, version=33145,
count=11, id=259, version=33145,
count=9, id=259, version=35207,
count=16, id=260, version=35207,
count=54, id=261, version=35207,
count=3, id=257, version=33145,
count=179, id=1, productName=Unmarked objects,
count=1, id=261, version=35229,
count=21, productName=Unmarked objects (old),
count=1, id=258, version=35229,