-3��W�� tٰmn+3Q��Eг,V[S���ŪMG�/5Jʠ�7�M�RX�"�:�dBW�[4�N�Kl㚷w���&;��w����K0Z��.�P�`##���b<���Wh�*��狫3^����apT�l�b���-�1������ �lpǃL�'D�naGm�+��nO$�>��ٕO���)���pb@Bu���Eo7�MXXZ+��=���{~�s�Bb�M��P���a�~<�Q]^�����vǹ%S�r��T�ae�/�qo��?tYP�\�s ��$��b��<�?\FR#]�~C?f(�iq ��dH��'G��2�� ���C�B����A�.����.���{d�q_��V|pc:y�]�{SqX~$�m�{4.5�����i��C�jQ���b(쇡�����O7��A�j�lZ�J>���i&e#��(��0�D�u|p�c�Ze�Q��_�Cd*�ES�M^5�6ۂIbM0�0��͡�����U����:�،݊����:r��Q����'Py���P0;��)Z-s�&e2d&������#�l!��;���������n!4�p�X����諓,�=�H�z��f�`�5��L��fʬ{��P�E�sx��t���a�iδ�0cXD����fwW-P[G����;��7a%������ F,`Dz̖~R-�{�J�&4$�v�f� ��y��Xw���zK��+B�®@�DZ�߸L���w\Dܰs�{^҆� �)���������+�%�[��}k3��@M��=�����W�Viz��j!$+��k��?�>u|=�L�=Re�44�Irm)�#0�_i� Y=I>��p�9�ׂz*�p��v�0X��2�\ymCo]���y!�8��3$�����P�蓞31| �ev��%k�6I��-�c(4�X��-�яB��7:�/Ir\-��PT��nB�Je�k��q�B�0���n��g�n"�t �x��h7p�2�F����^�=i���?�=*�-p��� �cQ�i�(��G���i�yʍ^\B·F���Q7�����Et:Ҹ�iz~�MbE��mjXI��0�Qv�� P�>,^9�K��E�4&)q9ڪ�-M�����-kUD���O��p�����mj����E�2�)ꯉu�1�����G��0��F�sex_�ùDK��U.��GXdJ\� ���Fq7Z���C�j�r]]�ڜ0�*�V�������v�jp���VT>���&�a��;z^{ ��2̦��&hڰ�=�s�QJ��{��?!k����@���Fb@���ɵM$���k��2I�&�� �?�۪���Hz%3���̝����eI�Î�2�L�z �u*F��?���A07�� z��@���CJ��M�Kt�%���[����V��Ƅ�H��}9N�^\_����R�S�/��@o�+'�e��B����fu�G܁W�����8�4Wu�#�S�g�W�0�U=^�E�t��S.��6�c�W�1����*�� �%H.���7�^�Syߩ�H�E��;s&�:�2�Y���iZsc�10�R��{�T���r�Y�TK��h}��c4n����.?��ȍڸ�`�0G1G�@��Z)���L+�����aZ���(���DןV��v8��>����a�k�k�vr${"����GS�ʳ@�K�5�������+�K�}I��, s���a�J�2)��hcA�0:��e'��V*�ɧJO�.��0�=�}��˨��!k���6a�gC�M2jޚ�k��p��c��u���{n+Ex;��@���Q�c�q������{� ���oc����ZB����Bƛ�L�L���cC�������$M�䀫���f1Q9���٣*>7:^HG�Y6#�0�LPX�ζ��׆�gc��L�����q���+�G�8 Y��u�z�F��`�[��=|V���ƐnN'�!31�/ڷa�^�������@�S� ?W��!ާ���� ������{�ɯ�ͿR��� �#�L�isi3�u�~��6bV�����}TD���܁$�[�n���������9?rq��DtD�DG�6V�Ugk�j&�%�o���`��I�ȼ!����l���)4�u���O'/��k�۱� �*큔���=����G��������5c��ݽ �jWZ� �L+Wʆ�)�0�3h�Zj7�^�l448ˍ7]�w<j��{8�O��)!�N������p�U���Mp��I��i5z�����~��kħ{����ޢNiR�����F�� Ud�KP`��E���hP�����Eޓ������Z��bPc�p"@�:G�մ/b߯v|F�s���y�����M�<t��+O�cJ2}����@Ms(��l�2��x�K=��mS��td�L��|M$��[/&�}~�/E`ؒ�q�q_ļ^���5o��^�Wa*��]\�:�� ����M�d�ǜ����|څHX�(��T�F�,�(�v���"�4��B��7{����H�4ܲ1�;x��i�Y �Fh�Ps�Y�@��������}g��k���Y��jgN�9�)J�L�-����рB�B��|�K��V����� p����"R?�:�'!���y����+���oP<�l�]�C4�#���t�6x�h[�h�ň6����)�~rA{�IWN�u"���~q��kE W�O6 �E� AΣ���AR+�y� ������\�Aʯn�rK������u��7�_�աv�1'=Љ���?����ߚ���q���0>��g�K`$_t0���Q��m������ Tt-D�l��������Jƺ�-��Ҽ�g��ȗ�~Q���N���=vC>��|N�ư�;f6S���)T�T�x�3Y@x�G� se����M�ay�(��3�L�i����$���8B�5����G�\�� a� �����/?:�{>,�7��'���SV�{�������AY�أU�Dd��T�b[۰ֈ�ӌ��]WRlŧ@/LaU�������-o#^�I����2���ԫ (e�<1{�k�8��f��)��LdE�I�K��#�q�r�ĸV��}��?�
Static task
static1
Behavioral task
behavioral1
Sample
SnipEv2+11Tr-LNG.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
SnipEv2+11Tr-LNG.exe
Resource
win10v2004-20231215-en
General
-
Target
09f49d370f9d4e6b08e8ba55314f19b2
-
Size
2.0MB
-
MD5
09f49d370f9d4e6b08e8ba55314f19b2
-
SHA1
11de6e8064088246f634c543e028737ff1b27264
-
SHA256
46763a8c1a65f79b506c88b92258afa9257656a1a4632dd8d4321cbc0e6ada4b
-
SHA512
ce9104e3d5e21a7202be0399f5fba943afd9417c606b5bac1e8a78c791d0ce0c21ee9ad01f5a3b5cc511bddf2ac9c67f15bd847c2ad4a7032d7ab9ae5141750b
-
SSDEEP
49152:VGwU6V2ndXjj8Nvl3DEND76VRtXYJm4pYHuuBTkqepn/K1pAHCAKJ:owj2ndTyvl3DEJ0XYJTpidMS16iAKJ
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/SnipEv2+11Tr-LNG.exe
Files
-
09f49d370f9d4e6b08e8ba55314f19b2.zip
-
SnipEv2+11Tr-LNG - I.N.F.O.txt
-
SnipEv2+11Tr-LNG.exe.exe windows:4 windows x86 arch:x86
32363fd6f38750fcae5f44a0f3e26564
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaExceptHandler
kernel32
HeapDestroy
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutGetPosition
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
VERY IMPORTANT!.txt