�C^0�*g���/���y�J�qY����K�n�fN��>�?�%R�����xm���I}$�r��������,�Ǟg���I�i>��@R'N�8�p��yF�I���Vw⺘�-����h��wEz� ~��@J�Gڊ��i�j��@�o��FC��)"��l� ���c+#=w�o]1������C��^����1�$�^SoLR�=r~�Q>�����<Z�y�Oτ.����|�\[��ȭO���¿Go�w�x�U�OFM�����|���#��Y�{���� U��l�qX���+������ȇ`��^BC�Yl�P-��u��el����^���5�� �AB��T��IJO_1�m9�e]&'Y��[�ͤ�c��W�]x�'�|���Q֍x��L{�"��|�OkA��B��v}v<T��(��+['\V����VXw�cogy�E�qXk�\�".�7^`�uUd!K�g���Xb�q�D���-qL���ჂUQ�������~�?�f4�R���Oߕdž�q��=��R� ڌ�ѭ*���G�n�I6ih�T4Si� $$��<:27e�W7��K?�����a�@ζ�d���!&��R���n]( �r���8�w��{�a�� ��y�G�Vh.c�,��`��z�@���F�>ܲ</���T�O���:�Z� ^h�� <eO��p:v&�F�d_�7~c9��S�5=uV�4�6�����`G�ƾ��Z��o���h� n��-�X�UH����+!S��G ��X�#S7�\0 E=��nHr�'�!��(�j.Fq&9��դ �XB<�/���fkH����R��۱�����Rpљ��R�?���i�I$?�"T=&��⃙Ѫ��t�M0[1|��Q:���C�#ɑoǑi����ǔe�8 |�F��!r� P�/莁H���>��ո�Q����^_�h�ǘ�W���r@- �s��Hˀ���xPAy��ng����L|th`餌8��u��< Q}9�~�~��B� Ï���<��|;&�xԆŀ9�d�M]��|4?,(.�'L��q��� �F@Pu{Lٳ�j���yk�!�T�G�P���ZG ~���j����T�Z�J�6�h����� av VϤ��"���G���QM��%����^��.gA���Ŋ6��3�e��O!���E�B8��sYsX��0�= ��~F�ɣ4 ���_Pr��V"�sw<��RP��(�.>������D�+pRJ���`��o�iڿh�I���i���H�@����-�9o�֗�� ߜ��Wl=���b�,j*}��/�M��͂����"�~cnV�֏��-rշ�4g���� �� �ԔR}�~����DX���Ų��L��g��~bS�i�`��a�x���1����WP0���'�=�S�&��y�Y��~��tZ?��b����pSϪ*x�R�����akY��Z����@�P6R�?���ݺ��K� }���U�H�����x��|�ު;˄��~���F�Û�@i50ř��7l�1�$J�r��EӼ�Һ���7hB!o����}���2fh��Kt�C��ܜ4���E����������*@�A+�����.�g����z�n���ϵkz��N��w��8��G�� ^rN"e��\�<�0���[����*t�9�r���a�sީ�H��Gd}��'��K��4W���+���`�\�J�A3���9��/Lrv?��+��|F�+N('\��v�o"�VG)/N���r��������U� >F��C�6�m-�_`���^\F���I_�!(��K�ɣY47e4v�=�/<yM��Zo�.P@�ǀ88�V����u�v�q��Zx�> ~Rs0�&�Nя[|n�U1�Jx �ݨ*_+t��s�]��7k,�/L[��������\5i?A<~�NG]b�t$a�y��n��,u��\��+m�n�!k�L��������1�b���:+,��^ 5�d��3<=����Xf��0�g�:����:eUE2q�[$7Q��4f��ts��O�:T4�����ҳ��M�⊭��ݲ�>Έ����Q�a)�֨%����wZ���:qC�����q�Ą�u�37�(�WRrNG"��!q�-��Rl/�1�"�w � e��A������W_Q�qA]dh�\VO���qÓN����N�_�3�1�}q�_����\�i�j��T/U4LU�Dh�ka��R�s�ϱ e����N�t�*��Qri��g�]M��<�Ŕ�eE�v�J�`�@�"���٠(�H���ޝ@�Ld�N ]��`F��I��jL�������J�#��/�0�.N����,KY;�cK�@�nj�#���QB"����Z涞X���X]>���v����9�ss����*�[TOs��E�Fݫ��rQ���an��{�� �Q6k@j��8�����j�t��ojN��Mk�a��/�* Y���nhc|u�ENꖿE0 �[����2��K�"\v���}4���B�^M�uv�*�����JW�~�[X��nl�%�6�������W�#�~�ޑ9�>d��$�k&0X-8*z$��8$����-��Bj��,�,f��sP�{I:��|ne-�rS@'���4��)��.C{���~���ح�%�l%D��������Uc��s�N������σ��@ �E�M �5Ld� e,�N��Lfx9���d����47�;��5�W�JԀ/�����3����8��9� ՙ�r�I��bp���ra��߱T ��@�m����_@�0|���h{���۳2^jG��}�mY�k!� �dkֱ㛰���k��-4��L���\�;�+������` �r8��9T��%�g�,���"�x)�$�+*�F�����s2�O��� �!W<D� 2^�=F�z�ʽb�ѣ��cբ�� ��u%/>�L��.��W'Rwƭ���� ���$�I,߭�{��:��3� V�a7�5})8A�x�ЋG� P�6��� h�N?@}R�*-TP�x�K*�?���.��+���,������8�$KH̺�$��_�dl�.�|�}�TA�ҥ�+
Static task
static1
Behavioral task
behavioral1
Sample
ACR+11Tr-LNG/ACR+11Tr-LNG.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
ACR+11Tr-LNG/ACR+11Tr-LNG.exe
Resource
win10v2004-20231222-en
General
-
Target
67017f7bdda13b0deda6b85e1908b2df
-
Size
2.2MB
-
MD5
67017f7bdda13b0deda6b85e1908b2df
-
SHA1
a427d088c0417343ee8770ec3522af9b1ae78b1a
-
SHA256
55ad43218e3f8aba514e2d69c54f3e9f7c43d85e869274e4cc86cb1507e9a6a8
-
SHA512
06bf0ff49d09b8d84f262d472e6e5a9e976d40b8dc71a735050b9a327dc85728183b95e1bcf17b7d1e5e63dd23eeaf76998123347498ffda2530ab06eb82eaa5
-
SSDEEP
49152:4vONLqdIMDeBpBkmO7gtxjT3XBeOVG8eG29Jx0:jqCMDiBkEfjw98eGUI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ACR+11Tr-LNG/ACR+11Tr-LNG.exe
Files
-
67017f7bdda13b0deda6b85e1908b2df.zip
-
ACR+11Tr-LNG/ACR+11Tr-LNG - I.N.F.O.txt
-
ACR+11Tr-LNG/ACR+11Tr-LNG.exe.exe windows:4 windows x86 arch:x86
e679fe446926336de248273d7a2f7c25
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_adj_fdivr_m32
kernel32
LoadResource
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutUnprepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE