D �� �^Ku��O��]\H-U"P��t:?O��`�� >���}l�1���&6���A`�����Kme�F�ӭ�W�aao�6*R���|Y���b�є��ۍc�N-ijM��Z ��'�YbCGh5g/'*��ͱ��������I�iU[��[ZQ ߗr~o@4ڻ��Ƴ/�g�;0�E�[>p�,ŖMt?+U���\j�)lt�@<A�9�$q�6E����ȡ�*��.^۞�uBn\*I���d�%Y��sp�>��$�M��Ui)��HÎl�%��L�IȊ��S|�J��ǰ]oW=l���d�6���Z�#�1����ԯU�)�"�+O�t��` 9��)q�G����Y�"&�nY3ڙ�����A��h5~�9�S�$=g�Mm���w2Y�9z�L�j�a���+����T����VH��9E�s�IH��w̫���(?����5Gٿ��ѩ�������MEK�w�zx��n�~\�����Q��ĩ4Ji!K ?�2�[�FRh��V �z��F�ɷ��nR �����x�bv�K w�+��a�/Z���W3�%�.~V�!�7/3&��@�x/�jw��ר�9�9�f�L0���лCDy��,���%۞6k<�k�|�X5v=�������������s ���I%��p:N��g�m�x�!�֡R�-�q"Vu�p��l��,����a����*j@�� ����`q�#�T 5v:���$�`�˲eX��z�gu|�0��w�Z*����Y��]���Lέ6��8��R�u��oY��``�siU�`m�����0�Q��E�i�2�"ء��5X&�ȗEA��>6�O��Ǧ}��7���C��ڝ/�#�̮��=�x�z!=n-���.�GYG��\��[�e�h?��eh�Is�dH��D����(�$�mc���{Ǡ�S�ﰎ��G�{de�>��{�l������`�z�DK(ܠ��ùS�?�\���;�t�� ��u����*?\���|�:k��R�s���#Wȶv&F���wk��KP�s�����9������+�;������2�H*���tU�O�3f�\�/�G��Q���7��T�(�Ϊ��V��a�P�G!/d�������R��T��RAXXX��`�a~���ĨI|AzE���L\�)RUV�$����/�����7��-k0OH2�ךQ��.˽B�ӿ�a�'`l�&�Q�Ү��Z������ \�6���p�c9��H7�I���m��a���f��f�y c��\t����;��N����d1�)������L����v����=eCP��t6�wX�d���l���~[�*9�j燀8��kv���ޕ����/,J�7p�[�y�;��9���d�og��TUȊ���X��KJ5 � ���$D�o��V�?��A��JT����jPG�ޭKZ5 �O�_��+C`�� {IM�f����2� �J�Mu��eV��:�s���ω����ZP|��̅��&���5�+ݢV_ B9�¾�ɣ�H�?��t��=6��ϯ}�b����9���A���^�ja��2vS�� I�яu��Co�&�Kt��!p�U�X����ۤ�J���l�n&���,1<4{��Fɘж�@����L��O���.sq��u�sTQ�e<���{I����F;�\��������&��]>�Е9�1Y{�x\W�TaG��Y�A r��A����[%c#�Yu�\���&�;|𐭫��W��Q��ۃ.�n�nȻ����_���9�>�x����lֳ����֠v�ZR':J6;vƙ�x{zE�|��z�����.�rm�����{�� T��P!k�L@��I�KH��m�x������&m������C��b�,��>6�e���B�h~aP�}��ADŽ���M�bXtPm���:;��ż�����ҵ`�1R��u���ј���6Ws+���yA�,D1�hUT�HL����8t�}hNlK��+��8��<�A�{-���.�f�q!�C���L�y��{�I�78�f�����H������ څB^l}_�X(5��b�^(�M�ªI�9sY�0b��~N:�����¹�Ç���X���Le�s���ʢ#l�q>kR�C��X6�-��qr���4ۓ6� ���0A���ѴD���?Go�F���+W �GY���:�w0��D�W%ee=7��d�������qOjomnS(��8�'H7N>��w�7��X�Kq����sz�F'�נm���H���Wö��ͧ^���K�%�Β�y<�����9���g%s&1�4����d�1����J�0����{'pK��j��u��Ȇ��6�l�B�ք�398}�z>!<������d�`��q�jcz�P�� C�;�:D�����8n��(_�H�U���4��ׯ�Ų黳�]�A�q&<ց8e�(�j3������S���ި�k|���R�8m����T��<�$����}�;��33dH1�j����6_�7��5�GͰ�7��<y��k�R��6z,��*�Q��#jI�A���Hせ�d���h�;h�eW%�C̜�B�J�K��a��/��2�M��+(�$�$�-��pDM\[��D�ZS^6�T="�w�%�p��d��P�Q�^���7�_������W��R'��� K]�/jC�����B���I}NN�E��U���]�9�� �Mb���)q�>��*C���>����R�{��h^�{���G�3�j��*���TqD�}���֛R^�n��un���&`�"����j�S��x!j� �q����e�Y�Kja���8+�A�͘�.�g�"��Q���!+'��>*�����x��@D>3,��<RX٠d5Nk�\i��E�eG���kɦ�d�/�Ѻ��x�>hft�A6է��C�jU��d�]B%�����vj�ݔ1_���yG��G�*Y�T٢��59�L`����)�<j����Z��D[�T�hڷ. � Ls�p���' ����a���m����8�d�!��.��D�~�Ae ��a��{��_FC�m�5v����["�����.F�* D�e�ANEGv
Static task
static1
Behavioral task
behavioral1
Sample
BordL2+20Tr-LNG_UD1/BordL2+20Tr-LNG_UD1Fixed/BordL2+20Tr-LNG.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
BordL2+20Tr-LNG_UD1/BordL2+20Tr-LNG_UD1Fixed/BordL2+20Tr-LNG.exe
Resource
win10v2004-20231215-en
General
-
Target
06ec43f8c89095f70fdfce7784a4973c
-
Size
1.9MB
-
MD5
06ec43f8c89095f70fdfce7784a4973c
-
SHA1
2465b1b06668f643c921e1a854d366a12c3eb87b
-
SHA256
47ead5d21519b97d0890175736a8c43dcd579aab8d60472a2d2766c3da8cf3da
-
SHA512
74342930ca5bdab414abd6c5d3ff10dee7eb8e1656e02452e22bba2d1fb2e7e6aca1e4b4175e5fa894ed263b2b132b297772f6710253327ec8ce13ccf47889b7
-
SSDEEP
49152:O7mgO2QXnSWm0uZU3s0KxlR5rOxajZ2J6e0Xo:OaRdXSWmtZE0lf8JBn
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/BordL2+20Tr-LNG_UD1/BordL2+20Tr-LNG_UD1Fixed/BordL2+20Tr-LNG.exe
Files
-
06ec43f8c89095f70fdfce7784a4973c.zip
-
BordL2+20Tr-LNG_UD1/BordL2+20Tr-LNG_UD1Fixed/BordL2+20Tr-LNG - I.N.F.O.txt
-
BordL2+20Tr-LNG_UD1/BordL2+20Tr-LNG_UD1Fixed/BordL2+20Tr-LNG.exe.exe windows:4 windows x86 arch:x86
1d72610beba0d4295b0228c3c1b8dbcc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaRecUniToAnsi
kernel32
CreateFileA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutPrepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 1.9MB - Virtual size: 1.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
BordL2+20Tr-LNG_UD1/BordL2+20Tr-LNG_UD1Fixed/VERY IMPORTANT!.txt