s<4f��O�̭��ӹ9�'�����G*̯txv��;�C�i��)}E�9?Z"1�v�/F4*P�&P�h������"���n�/���s�.az�B5dO����.�0���Szlt��p��#))���z�������hj������T��b��VXC�uˬ8��*[����1q��(���DC����;��K��1�_J�O@��!'���P����������z7��%49 7�%줻�"��\ٴZ�[W#�x}n�Ѻ8˟*�ˈ2�Ҭa�f�Vj��`t*phK��f����_JC���/j�^�$�����|i�3+�G"/ ��|EZ�;�l|�͚܄B#�d��0�Cw���#\�}�� Ɨ��e�g��V��\2����Ρ'9�R�`��!I�W�v�f��7VJ��/��]� :��ql�}�5���]S�UkJL��@*B����a�18��>Ly��С8�x_�m���g��yt�'Z����a�nNbi||ʖ8{X�p�i��Yl�^+7����f��d<�r�!7��5�T&�C������I��}x �IY�Å�#��"I_-yj͑S>j�z��;K�6���*f�� Nz�<x�O(X�s�h^0�>��8;L$�y�E�{8���V��x95i��S�nd�5��u$�l�D��+G��CJ?���r ��� [�L1���12��\:���E�Ьh�y�)������TXk�/���H<b�T�$�?��5z��4+���A�,����{�M�S�q�����=��B�r[AVD�%<�������*��$"�s��g�؏��_�8WV���%Q�Q���������䵸�T���SDb_��b��^j���!���7�o9G��!��MW�4��e]�O3�~�[�m��g�&ۑu�3W\�����'{���u�I�5�_��v�D�h48Ɂ���L��\r|8~qn��yd�PݠRl���~���˲��|&��6��]�( ��e�xe�H;K����:� |�)�u�4�A�\�{���R��� %o�0���� �� ��N=�k�y�m�(�$�{��AMk�}�<�@7#�o�����������@>��Y�I㝸el�3=� ��a�Dˋ�QK�Ȼ��"�))� ;?ly�}#�rz�gs�#j(a��" !�G���;Hӯ�&)i�;S���ī�CC�Gv�}`�m����<};Yhn;*M�!�)}_��8�>�T��t�;��W_�'��}��������e�W9&����n{���frD�jKI�'�ל��9s������QN�~�0���y�{��FL m��qJ��o`�<��J�g9��r8p�.7�x�Sk�Rl�ocAᴒAo�F\u����V]�=��@�`��V��{���aL�BM*���G@����Kl��в��o(e����u���qm���K�r�{�� ��A��e�V�"QJ�����p�c,O� g�ڹ�F��L5v��P�Xш*nB6K5P�ų��9���D��^�So�II�n���?'���Y�_�1�%?kM�2�p��I� 9W���&�"u���6���w��-K&��W��WB���[fK�.�-��9n��KS��I�;����0�`+���� I<Z�\��#H�Lyn/�r�A����u�+F1��/�'�|������I,-$]G���T��`������'9��}���ivDp�D�2���<���I ���S�l�]m X����Q��������!��'�ru.0��Ӭ�+k�taT�(Vt aX�Th�Hy�44f!��3������e���:��R�<2�P��3,ݧ�(�����?����p"�7#V��ÏŁ�t'+r;P�>�k�[�ZN�E�wf�3O�&���Ǵ�MC1�A)�2&R��|Q�#�d��Z5HɆcr��ù��vl��H!�$ y�����d��me�,�ԾI�h���j�������(�?\G'�����!S��M��qr.�]?z+Am��7<��S��]���mZ���È��?��Ȑ��.���8�J�kؾ��Y�r��C�{���։���e��"o��+�w���z9ޜ��M4v���:,���*�/x�cx8��g���A���x`R^9���� ��;�� b��a�J�A��T�ό��ӛv֑o���C����!��-�@?�_�����<�J� �s�x ����K\��MvQc���8W;�Yb���� �_����N1 L�`�N������[A�g�ٞ` J���uX]��I�e*`��9/��=>EZ�e�4�{t��!R�/�2���w :"��ŃZ#BCa��6�2�) ����-�W$p�7'�R�uV+h6D�Npt~m�EP���,�w��c�D��t�ф�����s�Z�V�?}�@<�а����;���fV����媷�i�jUz�_Vg�u���dU,�iX���iP��D�.�LB �mYL!�t���/�dy�ͽ�8��1�3�V���a�=tE��F�!kLX��T�w����VC�,�1S�����zj�+��l8j��0_�8K���K�w%��Հ���H~q.G���`D����B��x0�U�-h��r�&n}�D����_�v쐶M�/�̄��;z�:.Cqt�.��/^�h� T�Դ�Ǒy!R($��>���S�����������ep쇍��~�U'������ŵM.P����՚c7ٛ��!��f����A���<Z��ZC�t����<��f Gd���C�d�Do{�ɷ����Dž��q�u����x����Q�Dl�a/ܯ�iϱJ4�דN`�}��]�؍�1Xa�;|�ix9�M���W4��P�q�i��X<�T�n� e�Ȏ��55)���@��>�o�*t�5�����^���:�����J��8�ڂ'k���g![A�W/�}�ĩ���z�!p����nu\�Dx�E9̇V�F� ��f���%��Ύ�0ѻ�}�F���hr&�Nm������ �z����T�4�c���ί�w�dޥ��������6���Q��K�b�p!{FK-���@�o���+��}��Ю����"��3�[�/CQ�-�Y��~f��5��SF�r�Vp�Q<��QXL�(�8�j�
Static task
static1
Behavioral task
behavioral1
Sample
DI+25Tr-LNG.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
DI+25Tr-LNG.exe
Resource
win10v2004-20231215-en
General
-
Target
5a6a0060032b6eafe0035bceca42360b
-
Size
2.3MB
-
MD5
5a6a0060032b6eafe0035bceca42360b
-
SHA1
1f37d39e4f91c3fc7dd58cc1fd78bdcd94d9abea
-
SHA256
40bb97135e04b30dbb547c9f26e0d307754e29a488837b6c1c91e4a2a94c63d6
-
SHA512
7a8df726897ec4a063d9e7de7ee07e0acdcc0266edb32613f9a0cf814013980368d323f3e20c034c6eee7d9d302abd0402ca37aea5d3b176fe05f94afa821394
-
SSDEEP
49152:5ZIRRAUgpZavz4kazOduQtKmVDKqSD9hMEPCLw8RYhJG:5sRAUgpZaa6QyKm8F9hZPCjRYhk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/DI+25Tr-LNG.exe
Files
-
5a6a0060032b6eafe0035bceca42360b.zip
-
DI+25Tr-LNG - I.N.F.O.txt
-
DI+25Tr-LNG.exe.exe windows:4 windows x86 arch:x86
efa90f75ca9aec49e8dd81e36463991c
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaAryVarVarg
kernel32
CloseHandle
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutGetPosition
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
VERY IMPORTANT!.txt