$Y���~hV����?h<�vg��kw���b��z���b���a����� X�X�W |�b�ɂ��Z�Kp�t�x�h@"_`�dp�����Cdx��ˊ��NLK�Ճ ?K=�8�+��D֪l�O������%���RR����0uP�V17ݣ�ٿzƾ�Ln����vF�8�\�Ms�E��[�p�gC���a�I��30�\|�����@�!`}6���X�B���<&_oCȠ�+Dl���"R�'�F����Chʓ����L��/$�<�xm���z�B���e�1Lت���^!��Ӗ�-_�rd~��̕��1qǷ�Q�6s�a�cJ���sD\N��O��q�^E*�5˰H�k^ v$B�Ѭgd��W͈mF"�ߋw2_�>�h�4|4�Jm&6��h���=]M���h�j}�У�p��e-/y1��jr@ɡН:!&����ҁc����q���%�97e|�un�'�փ�t=��a^{f����&�)��c����b& E���ޛ��C�?B�~���c��e�����l�8h���ǣ�G�s�m1�ξ�A[��n���5�F�^|д)�h�+��ۗ"Є|�!���'R�S��h �i�Q�Z�ex�ӯ'��qf�g��<S�F3V�l>L?\��(��9՛6�z�A�� D1\εR|������< 0Q�|����OVT��O�"�&��@г�NSr��nU3(���������_����!v��dO1�� �!@,3шi$\>@[?i9P�?�4S�aV昵�G��4<��V��i�W���Y �2�B����}��ch8bXt�l����Hаk���o�����Q� vR��1�mZM4�.�M��ك2� ��V�m<�H���I�ܮ�t���y�l��%�þ~�4����ϊ�L�o?�ӑHv����`)�e���Z3{�@�����0�S��5t<g$�o�����jr��p�Y����kW�ç�%����[G�c����m]�Ab�9z��G���/5��Bt�C��"w���P�x����b�q^���8���p�+Fθ��5�X+QZ�ۧn�u��Q&�h�Q�'�On�r_�,��LXw�����,��pढ-�����Va����Ԋ�6������r�Z%r٭�8�:�U�4 �y��w�/�#�Ԭ`��! Ա�U��W��ؼ��˅[)��A����y��K%&�l���prϴ�c��3��)�]?���x<s�OM�~g,����J�3 �B���7�~�܊ԅ��E=���e 4v87;�ɿ&�>��[��v嬗����/�� �g�,�%�,���6���+�t����pð�R���y7��i��z4J�l��U�ZAH�� ʹJ��u��" X2�v��;�ۺ�䵻� {��P�pT�R��Qd�C��/� ��K ľ1m�Wea�b��L]>�7�Ľ�)�B��cW27S���� �e���M�Q>����+H=lϞ��:?���s(���̢� &�[�9�t :u��#��u���F� 7�WG�E�lt̚�1!������!!��н)����ZYۛ�|��{�pc�3�Br[h�$ʒ���D���S�"4���"�Z jj���{4�4�ǐ��j#�_r�/G�k�Y�U���Y���� g�.���!#��Ͳ����t{���������螳��n~}�fw���e?Z�`���FB�{-��tb��1�L�T��j����PGd�!�^Jr ��m+C)���rL4��, n&���hEQ#��<��� �[%j�J?7τz!��o(�������us�uH�����^4����R�+F�����Qf���@Q���O2ԁ,o(|P�`�@h��֫aYh���~�A���mIͷ����IQA8~KM-�E��`PJON�ԕya��s#'J�ֆ��6VU2��L��^U�,u�#[�eZZB�v���`��h��-"���1�Q��_|ni*���]?{�`Q ��8�?�Ղ�J������`�V�=�8�[{�����>/J�C�^�������/�?�Dd� {[ʺ����Y�1�T���T��ŋ�>\`�W<*b��Ey-V�t�K~�(3��^s����(0P�;������U)�#�P�G���/����^Y�r#6�wf�oOUw�E�� R<�oK�R���fQ>l���K��n�2�ShՋ�6����;Y�) �嫵����I����J�(�CBP�V�T��e���.���5S���Uw�NeE\�:�2�N��W`�����d�g!/�,r]���E��%u ��>�'�\��Sa��:��b��������kh�n?���L�T2#��$��!���!XD���ybe5-���A��5�!�s!'}��{C�X34�0��7 �<�SU��y��f7d2���יǑ�����űP_���{:�7X�.L���؈Z� �Ebbm���s�cզk��>1��Y�b��7���!Y�cê����D-_Twj������9��榹o��-�\+;�q՜*|2��A_ZҲ�,�C餯�� *�e���T�.��zd�!G�;��U�Y�>�[��y|���~D��K���7LU��c�����Yp�)��zW���M>�ȰLB��� ug��rz���Q�'�v����"��� 28t887���L�gE�9��͗�75��dЍ��s��>`�c�# '��.� ֓�R ������>��a�/0n$<� -j?Z������P��Z�8k���!y��G:�Db�z I�S̷��2��M����0�-^���\{�M�%N7��;I�[�4��a��JØcp�gW�S5��d�}�� /$N�������LcQ���C&�sSQ�é� ��W�CpQ=���3L�*'�2�ɶ����u�.��o���&NiJF�uD5��'�@*����MH�[�v��q�̝�ah2?{��/N�Dd�����W����0��n�q�2���2����Lt�����$���g*5V"ްSI������J$����9�O��ԍ��p3�����+,����_$ZGR(�(s��뵋�чoGj�PmG��K]�J�����B�b1`m�,;0�9ea
Static task
static1
Behavioral task
behavioral1
Sample
BAC-Tr-LNG.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
BAC-Tr-LNG.exe
Resource
win10v2004-20231215-en
General
-
Target
52a8f8d52087341a25b65480e8359946
-
Size
2.0MB
-
MD5
52a8f8d52087341a25b65480e8359946
-
SHA1
ce1c87af5e1e295c22d6c5157f3716c4d99efc76
-
SHA256
a478abc355c74d9512e8baf14a6b3099bceda980616ef5507c575202b8444257
-
SHA512
8d8eb5a08ad07136a4d8f1db7e10b8411148fd46b13ad57aad952bc4a31e214765d335c0e7448340b448697fdf79e9a8739342b6f7a03bf84dcf02a5e6baf640
-
SSDEEP
49152:WlTVlwxJ6rmIqfzjmWYVl/jGYA4UnMOS/h5wbeaoUtcL1ibAHuT:GRdm+Vl/jGYARMOS/h5wKlA8I
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/BAC-Tr-LNG.exe
Files
-
52a8f8d52087341a25b65480e8359946.zip
-
BAC-Tr-LNG - I.N.F.O - Updated.txt
-
BAC-Tr-LNG.exe.exe windows:4 windows x86 arch:x86
398fcf79803bcc19b034adc1cfb7b96b
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarZero
kernel32
CreateFileA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutClose
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 952KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
CheMax.txt