��[�c�ٍ�0�wqk,p�{Ek�B��zm*R ���6��nݖj�����Z�]('<�_��k7M�����b�Q�z�~��!U36�. #\�!I*ޭ���}��nu>��Y6)�w5*hZ�a��s�kX �W�E�m��~w�d1n����6���L�uT�I�%:ڹ�f��Z ��]3)�>P���.{���d��٣��~ő� $Ø��8hY����;����,X�AIM��U���w�fm8�_�ޒ[�ƹ*�u����x$ ��t~���k*������V}8�<Ŷ����>��"wlCɇ=��4C���< �:�my��-�!��I<?�z��`��{�Ut?T��8+I�s�~������7�g����l���].���{���;�Q���F|93���� Q eW�b.ԣX�Z��(L�N�Yğ=��-����5צ]͐V��4+@�;�����)c7�t���%�R(��R]�-���7 ��k�b��9\�����S�s����������ﭫ�As�'�-M��G2 ~�x)^I�j��LM��4��� �#/7�{�E=b�����X��xx���U��f�B��R�D�j�sY����q��_E�R�� }����������g��h��{��� �E�Dg��[���G7�ּ���eùNw��8���f!-��Y��O})�o���.?Սҩ�x�,?0|C����v�_�MPB����4�j��e6�7�G� ���S�a��c�55p�Vs��pP >�w��s"�ݜ_��e�sX���{%$�sǧ��rn��xk�f_��ޠL������;��MS'����e{9�� ���f��*��W5V섪��c��Ժ���i�ɷ�֤�y�WXO@��}��GĖ��Po�(FSr e ��� �i��߱]w���%PC(W\�}�z&s���}�~,��~�W*�6�*���ˡq�|悓�<!|�g�,��6�)������LE� 0����t���Rl�d���4W�caٚ�$s�q z�m₩���$��:$*��<�2�����6�!Ŷ��s|�z�5a!S��Q��p ��t����:/m|�ڎ�_څ���N���=[�`�j�F�qG��>_�{E��Ţ�zb�2���[PӲ7vMv�ߘ6�wwmv��ۣ4�l�k,���cѡ�$���&\!�v��? ot{o�^�G���SF���3?�� ��y^�O���2�����z8���k�"# �AM��ayԛ�P3uzƤ[����b�R��/P �Q�5}�.D6M���(N�W�5����Bl���g&���U�а�+�����@�:���(�rR�L�"=ۮ���we�L���7[����jB�ϭ S���Bc�@$�U�sA��LjA�6��XC"��P���e0���bd���Y>���̘6 �Rq^����,��N�8"���W�F#� �����9?�W��Z�������&&"��O�����- �7<b�i����P��������V�u�º��D��^����G2n�N~��{ᭃw����D��gi��'��<7����k��h���&p]�Q���m�����ܮ��Z�HST;�p�7�X���Y{��B�t�O4��4�vzn7% & nvڦb �N9�ZT[�qγ� ��)� bp����`���Y����K��]���C=�����ڸ7��LR ���T�Z'�r#�ecu`�4�]/��8��5�����[o��}�q��ZX���920����}>l�f����3o�������>A_�dv=��o:�vҝ�׆�5��@��%�G���6?��Ÿ:�x������R�s"����`oh��5�x.�<�����{��7'�sl��6Ն���^CN�ű�*oA��\a��4U����t�� MW}~�ʑ����y�L�b���!!l���i���B=�4�i\��?4���V>QsX��V���e��h��T��@���:�A�C�|�*��y�I�����j2��l_�����<�����sXjYpG��\���MӦ���Og�yWbʹ���V�n�NpQ>�6�M^�4xll�W� ��]�V���!3��I����r�&U|7&f ��>��s���^�����i���H/x�L|/a����M]���:������[SK{�;}��v^EF�ӗ����[zP~�w.-��j��t�I���*�����M��/��m��`�,7���K���n�;O��������q�}qR3���"}Ɓ ��0��#�|\<:'1�Q����M��ed���3=�� X�bIr��*oL8�G�}����2�O�[�{����1e�'%b�v�^|!�%��[��O�3'x��U���,�W8]��-�/p��Z1�L �Q�s�qZ�j����Ɛ�e�cW�����ܛ���n��U҆n��%G�~�|����fl���ˍ���:�h��E@���>Vu����!�NadQW����J+��������,���#(�PԐ�l���~KB�����[|��FV���d�;�r��!E�-֬kϦ)xVuB η�i�<!��£�$\%��oY��l�4(�71ߕ�?W�]i�0�_�M��%z]%.�̐ ?�e�PLdY�����J�N�K]z�i���2��XX6u��|��d�g�*Y�w!*����Xa{A �ɠ�F����rwV�O�ILؖ|u7n�jP��k��V��ZB��|�o�Il�TJ.S���}cx|>����$��[IN�i���}��"E\T����9�HSu�K@�%�����N�s�a\F���(=$��O�z+ܫ%�FUW��qB���;��ۂ�m�Ou���O���. 6�Ux,�+�7��ݴp�be$�O�x�=I�jݒ���&�B������v8+���O��S($|"D�_�=ʽ��t6���vS�������B.o]���îa�s�� L���g���ڬ4���:,�,V/}d."Ӻ�����M �n�J����uF}�����{�"��ѺY�I���q&�зI+]�é��+�ͱV槊4���q�Q j��B29�1E�}�c|RS$�Q
Static task
static1
Behavioral task
behavioral1
Sample
SnipEv2+11Tr-LNG_Altvfixed/SnipEv2+11Tr-LNG.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
SnipEv2+11Tr-LNG_Altvfixed/SnipEv2+11Tr-LNG.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
SnipEv2+11Tr-LNG_Altvfixed/游民星空 Gamersky.com.url
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
SnipEv2+11Tr-LNG_Altvfixed/游民星空 Gamersky.com.url
Resource
win10v2004-20231215-en
General
-
Target
2d91b7546c1ca8bb5f6a87aa29cefd79
-
Size
1.9MB
-
MD5
2d91b7546c1ca8bb5f6a87aa29cefd79
-
SHA1
257fd717a2bc038d7867487041474c0bf9d70aa7
-
SHA256
70c903cb1642d57932827c2b6fcb1572d17bc2c0819563e9a6abd40c49404cf2
-
SHA512
32acc92bea81ba163b7671843be305fafd49988239eec560ece7885576bd76d124c44dfa472f83471487174e60b0634f8a88989348151f822b5dfa025d564463
-
SSDEEP
49152:bno0zlRY+O37odx3UI13RGxQPiAxeo4yJC1U+ezkdUmERo02:Lfhu43UI1EmPijo4yU1U+ekm/2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/SnipEv2+11Tr-LNG_Altvfixed/SnipEv2+11Tr-LNG.exe
Files
-
2d91b7546c1ca8bb5f6a87aa29cefd79.rar
-
SnipEv2+11Tr-LNG_Altvfixed/SnipEv2+11Tr-LNG - I.N.F.O.txt
-
SnipEv2+11Tr-LNG_Altvfixed/SnipEv2+11Tr-LNG.exe.exe windows:4 windows x86 arch:x86
51430a230eda3b08e083b67070743b02
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaUI1I2
kernel32
CreateFileA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutOpen
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
SnipEv2+11Tr-LNG_Altvfixed/VERY IMPORTANT!.txt
-
SnipEv2+11Tr-LNG_Altvfixed/下载说明.txt
-
SnipEv2+11Tr-LNG_Altvfixed/游民星空 Gamersky.com.url.url