��o�qӰҶ K2j�L ��(�r�����PFZ�Je�0>�31�Cv��E�N���T@��k�jN���� �n�T��B��_{_��܁F�V vHc�z�S�hf��ف:���G��P;�)�ѼO��p;��G��:-l�x�Ј�x��O�`��<�)�>��]\-����� �gǀ�D�=,���Or*�G���a�J ���b-i�]��;�/�fhR�,�ܑ ��my9�l٫c(o���m��Z���yF쨐b�.4fOl�m�3�6K]%v��[е���R ��s�qN��+#c}[7gK����3�'bk>������ }7�y�d�-{y@�Ķ��Oc�P���]�hB�M����L��z��^MX�m#���z}y��B8[�Y�&�����ҡ���e�,�ޚ��Q�71�� �D���a����۠x��P�P���K��"3��D���.��M�?�@.q�1!�X��Q-��f�&JHw���SП%��W;��+�\�}�%)����%�+��lኮD�`��m����=T\��}�˳��[� �`ȳY#���Ԅ���ҁ�� �s3;*���&4//��a�0�6������|9�-��٠�x=�4˜�\jf5u$ё�%�����ҿ�v/nк�hr/��������4�,5�fB�n?7��Sh�͙aʝZAB�#����2�$��_}����Fg���_�rſ0Ѣ����°��0������U�������{{<{D���:�Ȃy�ɷ-�*��K�W_�[��i��]��Oq�[��va��[�����@/ZG��/i��w�4/7�[���/��E;6ň-1;rx�"�k:��&�oa¸�:�ޭ4�/����"fX�������~��!7q7¡��l�cv�c��f�D3�d1���+� �O���h�����9މ�X��y��� ��t?�"f��<A�1.�I3��5狖�6xV�~���{"~k1˅� �4��(�B����� �6�� ��q"�)��b�a����c�����{�A�So��@�7�u5�+�~h 2��$-g M�++N�J]���͡z��-�인������i��j�3�S��l�����Z�"3�<��q����F���|�� o7������G�%v� ��pXc)�w]/�UFO�gy'r����z��ߋ=#�J������E���)\���4�h �%#� �Q����-4_���J����1D��s���f��qT��tH���㊌Je�E�t��?�Yĉ�E�U� JkK�T�����؎ntc2j�7�Z=>�Q[f��X)=Q��.[jE���a���"-<����`�A6��](�7�2�>w��'�ci�h��8�6�N&����?^4S� g����J˾�-��OԽ,,�o|����@O3cӤ����B���'v�����!�~T�8ƫO�����C.����9 ջ�k[���m:[N?�#��'�3��t9�_,��i�L�R�n��� ��������G�&��!�����YD���+s��3z��hmk��r�/�W��Y��~����r$�e�qN4��������:��CmE@D��xx;��!"�pO��Q�'��� 2��Nl+�R9�#D��.�]� ��}m�3[+f�U�n�1���t(�1L��D>���Z��V�g�(�D����^^<��!m�ҠM���~(�F��o�}���p<�`����h �|��� �4h�y �-�<PR���B�I�_�9ב�x"ci��e����ֿu'=�UkC�39���]�U���3xU��@�ݺT_G��z��PD=��B��h�%� ��1���R��k��=�9S�Td6x��ä/�C����-�.���VP����s���M��;Cٲ��g;����z���~D��^�aG�>F��x.m�9M��Ə2q)�`,Oj�w *dn�P�n��ZZo����J�RK>��`3Q*��� �xd^��Q��x�vW+Ö�ڌ�dr��/��7*�~ e-�~g�^������Mj!��L�6�)�����"e]�{�=�1��M|����,��I���WC�u�4���+`*�-�3��t��4!��P�8-�l�Zs'EV)��f���|a�����Ta ��S�e��q��Hh�8�/4��u Rb�g���cP���5�9�b�憝E�;�i=��۔�~�V�k�$�r|����<��E�� � g`��å� ��S2�iE~5�;�8�#��D|_�m�V��1{� #��f+��aٮZS��_�َ��2�j��ND�BS�����Y�}B�%i.��Ŗ4���Y1d��rA��6\3e3�)ng�q2�J�ٛ&���f��͛�G�T�1c�q���<_��'ג�OO���?' s��pp@Е�C'���~�[x��%g,��ç�`�iVz�ӆ�8���߸��ܼ7͠ ��O�XJ�a�*�Y�<}gD��U!��%҂%�fh�-,���4��L�眠�;#M��%��md�!M��4c_ϋ)�]�K�O��:�j��K�y�Q}���^0:^J��n{�8G��4]�����^=oP:Y�5�(o������c����ʂ�U�i1�*"5��e8��~�������)�s`�V�&4��oq��\4^����XF��Jy��ނj�����>as��l�V��� ͐�{���'p�#���#B�=��7ϐ~�_E��\�쾀 K�h����3���>��&��^�,+���v/ƭ�"���??��B���Ć���6���Z�5��<��#ī�4�r0����<Y���-�ܩg������(�I��f���Pܷz�K?�������̥�C�ǎ�:J�j1E�5I�lN�z5v,q�sY:| �� ?_��i�H&�P����Ah�SВ�,��k"��;P�.T�����GŞ˔�K4� �C�"�4{/��#�p��cz��� |[>L��+�8\9wUX��%��'����)�'�0B�����-U�q�v<�E�����$�������=�]�
Static task
static1
Behavioral task
behavioral1
Sample
BF3+4Tr-LinGon/BF3+4Tr-LinGon.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
BF3+4Tr-LinGon/BF3+4Tr-LinGon.exe
Resource
win10v2004-20231222-en
General
-
Target
89a47a6f4f499f3f55a33fecc3f12086
-
Size
2.3MB
-
MD5
89a47a6f4f499f3f55a33fecc3f12086
-
SHA1
087fdd916ba455dc03c18d7626a7bfdc5bfae28c
-
SHA256
176ad4d286894d51c0a45a02dcb6bbc31542c5afc08834337655cd42d82e6766
-
SHA512
5f7e51483e3e44554de9f6bf74c8b9f43ad04f2ac49461d9c03e50ef1c1da9532b4ee2e088dae51996c7c3e10b1934cea0e0224b6c15771b36903bea5c101c58
-
SSDEEP
49152:YpHxRcJ/zUINjRIuaw9YHBq0v0dYVXwO5EN+OkqQWebG/FKC7U73I4:YpHkBzUURxahxv0dMXwO2LQyKC7U/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/BF3+4Tr-LinGon/BF3+4Tr-LinGon.exe
Files
-
89a47a6f4f499f3f55a33fecc3f12086.rar
-
BF3+4Tr-LinGon/BF3+4Tr-LinGon - I.N.F.O.txt
-
BF3+4Tr-LinGon/BF3+4Tr-LinGon.exe.exe windows:4 windows x86 arch:x86
976cd775e6a5ddeba4dbd4b42b5d2057
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaOnError
kernel32
ReadFile
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutClose
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.3MB - Virtual size: 2.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
BF3+4Tr-LinGon/VERY IMPORTANT!.txt