����G�������1 �R��eQ��t����H����&/�=I��^]�Η�\1����Bn ���AU�ޣc��?���8Jo�j�K8C���.��������?��}� ���3��6��ek��z8�ܥ���q^��'9+&.�8�F�</���?L�Y��)��oJ��N/�X��,�J�u���X��C�8��B~��Pk`m;o��*����r�ݲ�"��B$��.=[,�3� _w�p��aۓ��4C.v�MUsL���YyB(�k�f�?� �^id��u{��N��m wO��q��4H���.�&�#�V�u$}H���� �/��{��!������Y�0Fb��/x�_��O�Jk̅r\cICYi�� i���F�]�ݨ�a/�͋K�g�l% 琻�5���f :R�� �9�؉�g����k3Xh���=��Vx���l���p��م�}���;�E������˘�6,����7��JoW�{U`�DK�d��:tU'=t�+I����iU�/d�YO���`DEs٢zy�ޝtt���4"i��0���2�K�8ؑ����vR�P�R�;`XG������� �I�6z��Q�*��O��� JP�t�x#� �GDx��L-B�=3%w�f�w�Y�SwA�8ȈPoC�p "����B�F��.ǒ<0{��`���� �}�m�,����5O�u�P�p~�y���*AYdFbS 9�у{�~�pb<~����� ��*�L6��c��� ��G-�`V�:PY �!9VriY�v�1�{�^�t�|Ջ��j�NŅ5#��O������L���.�Co`-l��ݎ8���ar����5L�'�u�ϣHD�q�v��ꦗG��rq]rgU�J�R[B�`�0{�EЄ�i0ކ� ����օ��GʠlL]�s����8�E�L%��Q�e�z��&q%U����-'T͓ �����iHny��E08a�>���P�tB�&`��h�?7�2��V X�� C�/\E���N +kt�XQ�w��Q&������R }��*28����ttzh-5,��_�ޥ��a�%��2�Þ��'Ԧ=ؔ��[�%WA����}�ߥ]��9����-�t9'~[ Ia���i�=~dͧ��mh��w��ֻ��]����Sͭ/���8 a�_@:�b~�!��{,h?\A�*��1�J�:@H%��h�i7"��̬q� f���Y�����'�|#���?�l����<3�l������������}`s�0*r6Ꮎj���O�q!�w��i�(�v�K�fٶ�mW,��Rn��/�Վ�B�. ^b�j�����G�����G��I.݁k�$]uĹ";E�'�< �(51�x�N�&W���C�WY��=�5Bd��X��n�ב��ab֣��',}�VP��w]��[� 0ʝ�-���O��\��&�9N�vK'u-i#��JK����d/���N���>ٶE�x�Ra%����Χ�c�}�ͧ�<^W�vE�.=��&v�� >vɃ]�i<�q��9}3U2"u|UE��T�L4N4>w�>Րd�����[���I:Y���>���&@��d�=B��V'�������׃��*��������e2�F���C��Š�4����wr��oym�I'>j�W�������HU�7��]�m�|[�6��?%��� �S��j�!�g���_�Uٜݝ��3M��mSW�,˩��t]�@��N͌G?�G3�Ӭ��!������j�[��� ���R�p����(�I-C���^�t�v���w&�~G��L����q~�-l�� X�NM� ,��4����ɓd{�_+��}䂧W@o(=�y$����&�Q����.%8+��e���Y��8}��52#N�E�fAŅx];aj���c� jb�� 945��C��,�A���kz�x�F�H��Gnq(���2X�f%��ᤐ�[�N�O��of�n�=)���˚��z��4�`�����LR�Ϝ7;O��n:* ����W��B���������k��`ۼf�%_V������ѫ2�>|^L����y�P*����l�2����I�Xg�Q���I�H{F�R_8��[�ͳ��9)���9f_�N�\U�3�_���K]�j���rs���s�������R��ցk3�&�OL�{Z�3I-=�̞NH@Y yQ����?�c�������݊f'��G'�&�>7dL�������*�蛘;i�Q���ZҌw��ςy�]�aI��䜘�t�Y%'���Ϩw�V������D����C��1X�i�R���� �� ��9Uɱ�:�X��FO�( ���X�|�<]s��6;@3X�\Y�U�'�p�i�/� �;����� D;v@�+�w��`R��Af�Y+mP��P���B�>�J�~0�m�V�6?<n��GctG�:�<n@��J�#� \�Q�ƐL����=�[O�u�V� <��U&S��E�������F!#�ߦ�����d�����U�q`��SL���)�o�Z ��@S���`-2�J�j�riZ{�ؚ}%�1����]���J����F4#;��T���v J�/�����Fp��l���CEJ����������7y���9�����+� �Y�SG�vho9֟��k��8ۇ���VF�ͬ�V���q�s��9�I5����BJBL�8rK���m��q��JL+bfad�rٙ�%9��� s�1OڪgZLj����Ȱ�OW�eI���G�>�ʒjUQ �ְ�8.����ZSK�듃�����ր�|�{#���D�k==[�{Rj�zAi� * ���G��Yh��8�88�&�`\n���%.�M��9m�β6����Q,fW�^�b�r/p��QDm��4��$����7�Nn����XI��v���EL�%�j�u�<��ɂ��_ )Il�Y8��\A��t0����A�͗U�* ��C5K�' S�,��cSy|�VM�����fp���,ѥ^?�X�� ����vh'����k?K���I�64�Y�?^o;���c�!e�@~��F����0�)��gQY݅�-#�>��szL
Static task
static1
Behavioral task
behavioral1
Sample
TMNT-OOFS+9Tr-LNG_v1.0.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
TMNT-OOFS+9Tr-LNG_v1.0.exe
Resource
win10v2004-20231215-en
General
-
Target
464206fced1ed735aa34367bb59acd9a
-
Size
2.1MB
-
MD5
464206fced1ed735aa34367bb59acd9a
-
SHA1
14c3a4ce18e442f0c0d77fff0992479c1b11865c
-
SHA256
5b321c1c5a187dbc594a15cc8e95d22dd8a217bf648348313f01b594cd0ec4cd
-
SHA512
2f3bb119bf50a6902eae592bd91d9beebd4e39b5789121a49596c6f4dd8c78453221360f5a70f73fd48317c6b43c2c399d67382d8629f9310823b13238f52a58
-
SSDEEP
49152:qzq1N7IeXNgSB/eceCYxbcoj1y7c6OV5VVDr4DIaEWT7YfVtN:/N7IAn2cerb10IPBd8IfHN
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/TMNT-OOFS+9Tr-LNG_v1.0.exe
Files
-
464206fced1ed735aa34367bb59acd9a.zip
-
TMNT-OOFS+9Tr-LNG_v1.0 - I.N.F.O.txt
-
TMNT-OOFS+9Tr-LNG_v1.0.exe.exe windows:4 windows x86 arch:x86
6f12efe973f12de487ae9d68444895db
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarAnd
kernel32
HeapAlloc
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutOpen
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 4.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 954KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
ʹ˵.txt