�g�֣Y�y����]��vtP@[�T�;�笊�b+Շ���Q�+�L>�{\�vV��??��ezO��E�\�������������t �\������$�=�i�܊8�����m네���6U�Þ|��D���Ss@�O.e�F"l [F��2;������ʘ'�ʃ��>�M�_�����"�n��1wi�9G>���Xh���,�MJ����5�[�"8���;t�����{{*�9U�t�p$M1��@ @U���SV����&��@{�7��KE)�Z�%�1��у�8l������a��S����x��6e��<�T��2ϴ���U�u�����/�:%xw廼N�m�Ob��Sg������n�1$�y�w�W������7��*�NŬ)ۨ'^����a)���J���z�Ve���ZIȁg����&�)���XcZ��ei!�2�����������>��;�H*�8E�Y�*�T;aD:3��������<G0G�_P�yU�T>2,jit��'��S ����J<��O=\X���O�˴�E������2���໖�5�ؚz J�T�15)5����~���Ӳ�i=u��6� M/�k���$3�p�Q57^�"h�2�M',[�x��k�%��Ϗ�b29%����p4��b�3�ɏR?mp�>*��} ���ؕEI?�O��\�X�ٸ��b����M��W����I��|�.s�� ����Vŵ�.{}����P��?'�.)藞��˃��s���NJШ��W�:1j �Gw�q���6#��b"�"�(̘���g��^��-ë']�{}��9�������D�D�E�� ��bzE$�{x����6E�[���S�o��8�,>��tv���5ռ<~ b��5�P%ܞ���|��(�,7��_�]Y�Ģi�/5��F Qۺv���U0�D'�-k�94���v3VE�� �B�w� �b���r�p-�)e� K¥`E��Uؙ�"L�#���ES*����$�A>�6'slvJ��.W���:���$�İq��¤Xʌ#��X�&��sd���-C�'|�\���n!�EH$���_\�6���q���Z����|�.�pz�y��y��df�S���D�k���+�3C����ua:��{h��C�(E�f�B��;�J�'��Tj���tjԖ̯��Bh�^�O��*��~y�~��=X��3)����3�tY�a:��L+�����'�&��@`Lq�u�#J�N��G㻴� /�}��}�+p�ʛ1L ݩ�y@�$� Ֆ�a���s_;�!3�3u��ؾ t�<���w7@�"��sa&�5���͙V�m_�Z�����}>9��r!��+�@o&a3�%ٮ�I��P����cX4s�#��3�����#0�1��)���>Zd(��� K�atw�?�-П<Kg�8́����aOF��ټ!lu��G)�xE�nz��5��[�Z�F* �E�8mR1w�&��(��C=!j�8١ Nզ�\��Ý�����ݱX}����8�9�z�KP����@��8n ���'g)�b|���ց1��j��k �a���[�j���Kj�ȅ��6�~��-�p0�4��D�ˆM��I����M�x��j�%S�n�|j�V�P��wޕ�3�p��bW}(,A����/Ĵ� �_Q���`'>��x�rv��X�����H������Ca]�����~g�Bcn�����C��ܨO$l#ni�Y��8�*b�\{���q~y n7S?�����+�� �z;��`�����k[�q"�C��>�z�6j��/;�V�9#�f� y����Х@���������Qˡ�RX��m)�;s(CЅ.�e�����o�=�~9W��K�����ڀ`�|*Wלc~t��f��H�W����g��V+�e�G��&>�m�'������c�!��h���S��ko�bN��qX���Nd�C�<���]ÍP<�ln0=�q��.�"��M�? �w-��?:[����X���Ip�o�q��w���[ߖo_rSJyc����ҥ_�T���p�<��R2&U��+=x��?��M��ߗ]� g6��/��P*g��T/��%��.� �����������٠!h0�JB�S|���t�;�V�4����7��5� �,�h5g5�c-��x��E4 W�X�b�H�X���@x�m�m����@�rҽj��o�1���3t~�"�\r��-$��J����yS����)_ˤ����o��\�zB-J��� �-���±.���=�UGO��4�驞(Bc˪s� �zo:�+b���XK���{���� �u����v`���)�6~g������Kt^ԯ�A��d�'zR�8rW�,*�ۣw=�k�~U�4Ӎ~��sL�8�<�;�vJ����sb9F7�����ܼ�YФn��0�e���ڌt����;���BR�g��3q�Z��9a)����1[�x�� �N�e���P��v�\h�>l��{�7 �S���Cr��� hJ�5݂� � H�h�R��W��(�sY~Q��3K�s���H|͘�PS1�|���)�+�)i�2��hHZ���K݁�l�[RB|�ȟ=h� h�ȞH�XM<��,Ke��b[�ϫѨv \��T0^�Rk.��-�fQI;r\����D�1�i���+�7,�N�Zxe!ԯw�&q��A< '3_l�����f�쭜��&�2�F�=���w)���Nl�b�<>��$�+4lr��W� ��bRۗi�k\SiV���}A�����G%��k*w��uU��c�F�g-�DA!��M6�_��G�9��pmgw �۾����3|m��d������L_�\�.���n�r�A!xr���>�`هM�~{ɵV|#�Ʀ�Md��WZ�v� g�C ��,k�&��n�XE2��oX�r$�g���G��D����]�\��*�F��� ���3��O3n� &���x#���xê6*2�`�m3Ԕ3�7�G���a�����}/���&��<��- b?�)K����Q'������H���RO�wLlmC����c�]9�
Static task
static1
Behavioral task
behavioral1
Sample
680/Club-3t.ru клуб единомышленников.url
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
680/Club-3t.ru клуб единомышленников.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
680/LOTRWITN+17Tr-LinGon.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
680/LOTRWITN+17Tr-LinGon.exe
Resource
win10v2004-20231215-en
General
-
Target
16a0da7260f9f63e99c7895149d7002e
-
Size
2.1MB
-
MD5
16a0da7260f9f63e99c7895149d7002e
-
SHA1
86ba978e70e540a961acd2a3cfcc662662b5fe67
-
SHA256
5f6ad673a68a57e06514531151a519a8986030bb0082be8a790e9aa6673ce178
-
SHA512
a67454f8ac14207047675b5931c0678ba3c8ced8e1ea2a4996493f294ffd9da67741b5b63808ba28dd0513483c12fbc4a5b2424d7cbb87610a345880908affa9
-
SSDEEP
49152:24J+g1e7QXlh9IqP0s0yKGQT2yQ2z999WPcnWGCiWNhqauCwBXgRuHt:mgo7ghRnvKGCJz99Y1NUgRuHt
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/680/LOTRWITN+17Tr-LinGon.exe
Files
-
16a0da7260f9f63e99c7895149d7002e.rar
-
680/Club-3t.ru клуб единомышленников.url
-
680/LOTRWITN+17Tr-LinGon - I.N.F.O.txt
-
680/LOTRWITN+17Tr-LinGon.exe.exe windows:4 windows x86 arch:x86
1ceaabc7971fe2eeaeb450ef14cea785
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaLateMemCallLd
kernel32
CreateThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutReset
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 956KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE