�����U�g�<����2,���c�=�x�u���XS����N ����gQ( VjN�TK5�y�\����j�n���@�Vm�s��عn����D.������J�wh��o�`�>�c��q�>,_��$���.���J�T��a�e�h��7A��Z�)�fH(�c���4!|0�<�+�:9��o��wE�q�Ajw��,�O{v��p��2X�4�u��k2��e�J!��ۓe������#���[�m��S�(v�����P�����r��'�m�>�V�j�{@�U0r 8��$m5hGaX��T�D�T�%�fv�P\ŠA�x�cS�m:M`�&�/�~,���*���)S�>K���{4� .�P��z��F�q�@Ymw�͓Ӻ(��to���C��M���U��&R2>Z�0�ƔH�Օ P�lDq��˚'� ��;����յ��^o�UB����~ �s-���O>���^s�eғ�ƈ2>��({�l҇�[WU�V��O����Yz�9z��L���"��t�8�89�w"p����4���/��WO,�gL�K?�jok>�47힟�]ȓԑ�{��w 냰ĀRZs��厨 P�1}GM�on]�w�m�����PA��d����Sã�i�y�w^/�ײ����>P����IA�1�-���qMB�?��2�%��IQd���jq�5��|0��o�V�gd.m����\V�f[F}�v�p��4\�p0 <�w[Қ&Kq�}�� vWX���w^��`�}�ʛ�5j �T�����[�76ȧ:ז��Ӛ_1���ݝ��=��H3������Xy��f��=��%L�o��FL<�4�bq?#x�:��c^:鿺H��r��q{o��D�ft��\Mxatn���"�0�\�J�6����^�Se��@^q�TQ��G��/,�g&��>qkt�j"�g�JGЩ4��j�V��|t�ز��f�,6PӪ����s�bd1���&�n��0I�RX⋖:/����m}t ht��+�I���&�e\�ܡ�^̪`�����o��(��<�}��Є��{[7=���܍�9h �>g�B�Aۧzk��$� L���#����ׇ0u���\W5���<i�.���O/[wh�W���N�%�MMN�J��葉'u�6�x�w��5��M� $a$%b�����������k��������K�.�WJ*�+���3M�?�A��U��xG��_���aO�F5@;�m�����6y{�LR�2��E�lA_P�o�wL��3�(=t��O���E�+Dk����h���$(��?*�g�I~��F�íؔ��8#��2R�� /eZM��u)� �snr�4V������颪���v]�����n(��i72RC��ϺS�~�6Ş��I���.�x�<�F�,UŻ�MGh��lAO��(Y7'ai�ϐ��!>2#��Oq^�0I��]����x썣ͻ�1̯���c�ꑦ� �V��ä���L5*��|�U����IɅ��ϛ��B��SR0��؟�3[�C��u�o%7��.�����_տ�ԯ� �� .�{$ ��.X���'b�� ��S�ڽ���,�н�n>�j����̲�D{�,?4߿?F {��ߍ���m���ha [�\��7}�����n�A[w����Yvg^��Cx= A��2����!G�������;�UZ}��?���j�c`+ �'����y�dL���8kN�R�;�9�{�gc�����;��#5��ɥemn�a�A0y|8���#�\�C3��^h�uajO+��Q��0��������ޖ�?b�b�x.4����S�P]uW2�(���r���$��bGt�8{���Uu��s�h����L����Tt_A�o�ǔS���:���c�_��=�K�dW��m'w#��E�d1x~[2q 9�nҖ�x��̻ �L�o���,/4����Zq^"������r�|�\*�e%~?�;q0r�Y-BeN��J�����R҃�/�����(�va��� |ܨ���< ssXD$6��)pmG���7xXn�o ���0��!_O�zL `��[����_Ђ~�}��P��i �ݻ/�=L��%��,�K!h_杛��-i�]̻�Aeʟ�{�Pc\�����1�7ݥ��~�H.� ɐ��y C�|��4��h+������M=��q�$�X��i0��q�h���&o��,�!��j�P�IUp��e��+m���������S���� �ŻXw7�����[���\��=Y���+z)a�g5& s�_� S��9߽�Ø2z��Сk+VGɏ��بBOq�8�R��&�}��d4���ah Y#v��������mp;���r�'T��c�4�G0�V����8-�6�u�S^�����LЅ�������P�&>\Ӫ�v�c5��?��&��>�ފk���" �tm��SA�F��ʢ^�p�*S�\u�(�Tܭ�(f��p�[�0U�:�B�8?Jw�%�V'���}��&�� �?E��-w���Z9��L3(� ��[3���u}����Z�h�7��d�$��T�T�H���`ʧ��Q����Hk�:������0��|b�.���2d�y�[x�I!��d�L�����NftӼ�D�'D�g����3D$�6H�2�]��@m�ab�Q��)e�x>;1���1���r�d3��W$����# D�~����9��fh��$y���tZ�낪ߠ@|l �}���>��G��Sc��s"����r\��4M$S�1�h|�;��Qd���.�ӥ��烐(���B�PR�bx�hή��OQ��))��znu�VO��K��=��P��D���]Nw��"S��ҫ��$_8�;��[�qA^�����w�9e�-�o�I{u)v.c��aKF���T�����y3�{��l�]�N��)O/�^� �UC���\pr0�(�������/���K4|��Cמ+~zJ��Ù�2e��IE5e�?����@6�����}?H{�o � �v�1f�FËN��p�B�H��j��d���hϧ����t���i���Ň�18ȕ+��x+t�e�����2BB%�P��,]���z��s\�@�^;���!�=G=
Static task
static1
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
Setup.exe
Resource
win10v2004-20220812-en
General
-
Target
Use_2022_As_PSw0rd-FInal&New-C3.rar
-
Size
6.5MB
-
MD5
77ab4c9e95909c304b7cbd744eb76d12
-
SHA1
259db9b4abf89bf20c1531336478124fd167a8f8
-
SHA256
d083d427c09ec1afea129f2c88baef755b51c6764bb7ad5f9adabd0522121975
-
SHA512
d13021f53baa3702839e22c6daa6aaa1b0131f823cad2e5f63348d62448dd646223e62dbe781d7b8b031c562b79d08fd7acb420e60d5cb6f145b6884d873d0b6
-
SSDEEP
196608:zBeEGpczolwH8myQShkcZueFw5ARZOUDf796W1S:Neool3Wr58ZOC56W8
Malware Config
Signatures
Files
-
Use_2022_As_PSw0rd-FInal&New-C3.rar.rar
Password: 2022
-
Lanngz/Cr0atian.ini
-
Lanngz/Danish.ini
-
Lanngz/English.ini
-
Lanngz/Finnish.ini
-
Lanngz/Hebrew.ini
-
Lanngz/Hungarian.ini.ps1
-
Lanngz/Ind0nesian.ini
-
Lanngz/Japanese.ini
-
Lanngz/K0rean.ini.ps1
-
Lanngz/Kazakh.ini
-
Lanngz/Kurdish.ini
-
Lanngz/N0rwegian.ini
-
Lanngz/SimpChinese.ini
-
Lanngz/Sinhala.ini
-
Lanngz/Sl0vak.ini
-
Lanngz/Swedish.ini
-
Lanngz/Thai.ini
-
Lanngz/TradChine$e.ini
-
Lanngz/Ukrainian.ini
-
Lanngz/UyghurLatin.ini
-
Lanngz/Uzbek.ini
-
Lanngz/Vietname$e.ini
-
Setup.exe.exe windows x86
Password: 2022
11ea24073ee65343ee563e3160c77fde
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrlenA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
DestroyWindow
CharUpperBuffW
gdi32
GetObjectW
ole32
CoDecodeProxy
Exports
Exports
Sections
.text Size: - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.;<W Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.-U: Size: 1024B - Virtual size: 896B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.o)- Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 464KB - Virtual size: 463KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
TheNewNote.txt