��� ��L��UV��;[��C)�F�J��ej��=�8�N(�s����/��W���p"�Lh�㬫|�x�;X�i��f�-��*��P/m'O=h-�dTPM����Z��U!h��=�G��B�qz |�T@�(�����Ҍm�3g���1P�)X�Q��dk@��(]�d\�(� M[v;We��H��-�#���pi���W�)���P��*D��O�p�FL�c�P�����c��pII����b�<٦�cZ�Gj�|��p)J����2:��G�X� �ʰ�b���?���\۰�ͷ����O �zk����LtY��&��mԕ��=*��ɶ:��]�m}s�h-�*U]�Hv��6v�b�f}�̓�%�v�Ě��f�&���Lnҩ�9��k�ʭb����<D�����V�]_��Meg?=�ȱF1���ncA�|Sx�<�T~gÖ�鎺,j?-�I�ܾ�һ����)�����%R��\�`Q�Вd93R^� ���l���n����}�A����$��|-�+g�)!�߬i9F/_v�`�T�+]���κ�, �b�y����Z�+]#�~�x'����ע^���� 9���-�.h� nX�t$3[�{��_ :��z���_z��E {��;�s='���8���1��J���Ad�<+i��aA��1�����u@,J�K��t��a9�bG.�`Y'�.����p�[���E�(�������jBڑ�:��W�d�o��y��U<�l�Xs�}'J.L�P��-�bO�#�2w�����=&岗�XXJؓg����4ͻ��ܪ��:Xݨ�g�������8�O��O�D���ul7.?IE�����N��_�� �<�U������Di��+n0��;�.������p|�@o����z�X'�����ێ1�C�,����6[fw�� R��(�2ؖ⥴�p7V���P������e)�'�@� #�*�]Ӧ[o��Tc����W�a>S&��G �b��8r�&dY���c�BF&�,W1Ǝ���y�;`ҏ�ljRe-d%�|M�f*ԇ�/������(R6ĨA����5��'z,�/���t#O����`':�(3$�(�B��K��v �dr*0D<�[�� �'C�ŵ�X]1��_���DUL���A� 7�'�Mඉn��JW������F�3#��t�Ҕ�S��W4aE��Wg�S���Bl/p1��R6E@A`�!%�=n��2a焵@���>���0ш%����cw�TwBO�.��Va1?@���Gj*t�9��J�J�:p{���#�)����VcaY̖�U�C�g��aG���{Z�D:�B�{4 �|�7�b�� ��Cȶ�+�ǰa�8��������U6~��Y�{��.�8���(@�;��5Hl�L�?bf}à�&С���䑪��Az�Hv�;I���ʚ�܃��Wg#�z$4�7C.��Yt��.y��G�K;�d����my+�� �hW w�e�s���Wb5]K�B��C�0gH����唭1���#�\��I���������K�z�Zd�Iz}.8L���H��ޢ�9�<�G(��*�'N?�� �V@B*nv��.Dv�JL�� ��q���f.Lm�/!�=� ��S�6��'yJ%���+a"n%�P��<AO%ʌit/L�ߛ�z�Ϛ����(/�r��7"N����Ѐ���:F��I�u_@����l���6��� ���������^���eW\������D?Pp5��#�v}�{Oy������x����!�~>�6�_��9���H� �E�(YSNZI���S�Y���Y��cǣP��C��`�d�D2j�)���d��|�O ]�.KW�&�c_Ga�h��3�����t��R�v\6Brʹ�e��}\�冝6�n�^��I]Kr���*oH��ta�$��4����P�#�������x�h`�1��_0}us�N��G��(�ehB�`U�u�@�\Wk������Sgl�DŜ��ۧG �)q���,�t�l���/K>��]i��r0����)�۰jM6%�I �$W: 5̾b�+!���r�e�n��.�5kV���HX@��}w��)�+��͏&�5���h��AK��q ~�uQ�.ܗ�ƪLS�{�?���smx�bG|t������7ϼ%O�5�T�>�:ޮ�1H��~fNS����g�������@���:N��P*m�N-����Ia�<�(�� ~|C<�r�ףev��}�����V�t�����J �\��8٘\��r�[o��;��gh@~aA�͌����"d_ԙ��u���L�*�����@������AY�>T��M����nP+�Ŵ4���i�%�gv{iĪ�>gN���>6^hN�-���Ok ��`����4[7��rSI�퐉�!ےjJ��/n)>�Tw8x���E ������P��@|�� �_+�N�a�trs���nV��k9/J� &;~ �A̘�����{G2���:��F��M�Z�'��G������ŭ��`I�[iK����R�m��b�ٓc��`��� �4A�}.|���̬���3da�U� 2��9����/A�2G7������ҿu2Jz�6�c�{Y4��rW�������{��r/z�b��Z���S�uh�'��ڜ&*�u���B��F��D�K]4��&4�ˁ5��39G3��(���������zx�a�\�ި�����o;������]�yZ3�Z~h����h�?]����o�^^b�!��&- �~��N�lL��"��D,���&@y�~�$;�!��8N���R��My��1�3��Z L�)I�z0���8����aw�6x�,H�7�:��ct:��!�}1�4���W%�W��0Y�t�,�"B��[��-����Jn#<�D�F2�'�$Ő���t1�=��p�F(J<-�g������f�g�����%� tIrN��N���^�z��0���'� ��ǹ0��^�S�$}]"ߵ�$��p�4`�`�,�#���� D�U���S�p��H�gƫ�"����( ���#�������Wd ȥl�!��
Static task
static1
Behavioral task
behavioral1
Sample
1572/Club-3t.ru клуб единомышленников.url
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1572/Club-3t.ru клуб единомышленников.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
1572/Crysis3+12Tr-LNG_v1.1.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
1572/Crysis3+12Tr-LNG_v1.1.exe
Resource
win10v2004-20231215-en
General
-
Target
0b87cdd5cd0fe64df6465c2c64681054
-
Size
2.4MB
-
MD5
0b87cdd5cd0fe64df6465c2c64681054
-
SHA1
039172801accc303fa123b521cd8aa531881f5bc
-
SHA256
3f3bb09d024efa4659126daaf34881070f51d85a5d24e1f37de1aade3bce3b50
-
SHA512
31cdd41336b0be184a4f7083c08183e8d6179c54b8d80d779b214af9c5306e92bf516a5489b0cb1623361594a858aae0d87bfe486d7ed26a4f7d8f7723c976bc
-
SSDEEP
49152:r0htcDXtUqPJdlYC0jthmHqSmD/ICvgR+6SDgrePofERSLsAKYgG:4DZqPJdB0xhmKvD/Ie4uu5IA7j
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/1572/Crysis3+12Tr-LNG_v1.1.exe
Files
-
0b87cdd5cd0fe64df6465c2c64681054.rar
-
1572/Club-3t.ru клуб единомышленников.url
-
1572/Crysis3+12Tr-LNG_HunterED_v1.1 - I.N.F.O.txt
-
1572/Crysis3+12Tr-LNG_v1.1.exe.exe windows:4 windows x86 arch:x86
e6af09ac204975858617b3ad5afd23e0
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord321
kernel32
WaitForSingleObject
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutOpen
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
1572/VERY IMPORTANT!.txt