� ���i��[&C/�o��&H6�B[J�����C� �ˣ��>��φ�����"�T�yFr���ȍ]���{Z���d�V%�k�F+���>���9�|�N�IHq�>9�ź�b F�������GD ���"�jQl��}��*���qh���B��H�z*�w���"t,�,��Rm�o�|�N<At���,ZrZᐍ�(�<�NL�S����HC@��:�#Au���,wA�h��+FƮlU.�A�~*��-u���˼k���Z|�oPL��9���]�y�G�Z7EB{���Txt!S)Q*-M�EZ�:��p�^ᐰ��J���Y����kB�9��*9yXY����rt6:^�-Mb ��0펷*��~������q^�7�[)�� M�az_�^�ÍرJ�5_��-�A=K�l.}S�k`x���%���^�Х��-��8���R���%��a����Z��\"%� x��g����c��l ��RŎ��EVΡ�ר�8�����e(�d�YA������\"e�Tn���^Z%���@�dN;ǘ-�O&o�1�J'�|L���[0V�p4�N��Nk�ZM�r>�6�4a�����i�H�8~��A��]���9Q�ZM�h}|��:�g���_˽Sq�p2y,��ՙ߭��l0�����I��e��$)�*��6�q��'��Ό{� ���� ��'k��"�9�.�R�.��Q�O=̒Z��S��>�����>�F��Ã�e^u N\P8{0Z(-� ����H�l L�@�����*;s� k��� �!+yn�S�T���GTZ��g��8�|�G��:���͵�ȸ�h�uC2%S@�O�|�QQg�@L�-=�~������ի>b}?�2�6-�9������V�"G�ZotE^y�jdy�12~<�ĺ���!�\��k��B��[��DJ�Z N����c��<]���I���Bɫ�7���<Jl�V>��cS#�(Uo�}����b?����LD��Y�L��^���j���6T^=+;VFx����C$�����aP�a��\0 h�Y�C�p����jM��5���x�7&��`�M��p˓ݎ�>;Kړ1�b��s�gC��4XW��c�`4����� ���ʸ<!_+���;r�.8�� 9�%���ȃ$����o�gA�*�N˧�9j�k>����C�W*5\�U�_�3�e�s���A��gZ��o:�^F���YByp#�F>��� �@�Pnߏ��ˎ(N4j;�x��K�<6E!�����������5��Ew���P{DR/9�ݖW��\�.�.7��0po�-��� !�W>�}Wg�Z��ŀ|6ܡ�4&�;y�G�_&G��]��Z>*�r&�rK#v�~4uk��ٙY��G����И<�-����-��!���Vgh<c֑3t�_�D�ȳ��=v�F�_b�oS���L�y �����m\���K^�4sߦ�9�=gz�y�E�|���y��T�╽5��~M5sr}&�"(�&�GeqIJ��M�v�fU���<���6C{�R*���U�=�{�4�����s�E|��l[hPTz��/�� ��?zff�V�>u��pF#-F@;��,��h�5$1&��zӡƨ���&�(L���M�Q��H�X�w�5%����j`�n87Ǽ��lj,p�l���fSNi�[#��&���K�}5�U)6S�Nް�p�O;w�^w�.�tv֪�7>����TTZ�^v�:O���G��3���!�2<�Ђ��1T�c���!aJ�i���c���E� ��K�@��Os��1�����O���H@���^bWC�B�:(�^�.�|<v"���F"-_s�]#Kq���_�,nƀ���m�կ��T�D��vO�})�"�<�p(h��,㌊���}�K�ll���l{#�v0Tw��$CI���V�==�^�0=]b��(HQw�Z�Ť��[�Pb�ǰ�@�}���3�.G�s'��b'����7v�Zk4��.";�xԒ�1����' ��t���8 ��̜�͖����W:6��Ӫ\ա���f^|��L%!�21��m��H��*jl���l]�/4P����y���W��à`xk��^�'lg�VH��(<-���֮O�W#��!���Sf�&H[ 3�@ ��DO��Eu!gf�D���:��g���`��z�ejlb��&�ex�Qp@�5⸱��X�}yQ,�M��^�β�ѹ�n�������J2���P{( '~����*�Ȏ/����Qv��s�,g4���!�$*5�1����\0��g�`9��e�ˌ@��)�� H�>��?��퓞�#�%�XF��ֿ��Y�ҭ�2͜#��Zi�f�n��z��+�f��IW����djΖ�H|G�b{�yc��m�T������p���ې]�<*&��ա҆�E�b�i�e�g~ ����W�BK+�?���� ����<Q1��y�&��.83�^��Q�r�zy5[$�E�l)�B�Q�i�ӫ�oU ,�%�Ӥ3iȼ������>ch��#7�k���]��;b2|1��p��&�����;}��Y��.�ݒ�.N�m�?E]f x*;���!��L�������5$E)��(���e]�����K����=�&�U�8���6� ��t7<�Ǻ,�~�O���PS���_�\}��$4A��-*��s�_~�>i�ٲy4�h�/��&hщio^����>�AIۇ�[R���H�t���z�(�����q��������M/y�� Dz��U�1ΣՈ�^�����ڒ�U4C��=�ԯ8�Q��D�.���x�ӊ�?��Џj+p�E!isn� �!;F�I�j��k�s���\,>��n0]�v �g��h����y_��x��q?wa?=�6�vD}i.��>o�(0���5 0��I}I�{�,�26rp�v.t,���Yk���w�ĝ���5�d����'��,�<��hބ��`��~���SIσ�C��Ϳ��&�ٽ���6��=�U#���طH,�K�B%�>���on�R�?)�{����#�%�Q�"K�)�|E�����o\s����c��v�!�8F��Z�һ�y2?��n�u&hC-Bg��ں^6
Static task
static1
Behavioral task
behavioral1
Sample
LPOTC+12Tr-LinGon/LPOTC+12Tr-LinGon.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
LPOTC+12Tr-LinGon/LPOTC+12Tr-LinGon.exe
Resource
win10v2004-20240221-en
General
-
Target
a2a508968f1bb8a90b64e7ed8a37ef00
-
Size
2.1MB
-
MD5
a2a508968f1bb8a90b64e7ed8a37ef00
-
SHA1
84a112eededc66a812fb09ff71111f95e5e3aafd
-
SHA256
dcba8d61624e43590102f770d40b33aa66f41f519bf6d8558092612cc6c0278c
-
SHA512
a1913371f429f113e9f6080c469560b15fce6596e9d2d197965622fdebe01b9cf3161af175bba185bed0812c32705278c9452316a021a001baf5cff05bd94272
-
SSDEEP
49152:wcdtjmz3XBKW7CtFRb1l2Ln1vvcopmhRElc+LygDCWrwdT/aXIp:nmzhKDFRb1qEh2CAt8rSIp
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/LPOTC+12Tr-LinGon/LPOTC+12Tr-LinGon.exe
Files
-
a2a508968f1bb8a90b64e7ed8a37ef00.rar
-
LPOTC+12Tr-LinGon/LPOTC+12Tr-LinGon - INFO.txt
-
LPOTC+12Tr-LinGon/LPOTC+12Tr-LinGon.exe.exe windows:4 windows x86 arch:x86
6a4e8eeeb92f740a5ff28aec3d1c273d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaNextEachCollVar
kernel32
LoadResource
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutReset
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ECrypt0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ECrypt1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
LPOTC+12Tr-LinGon/VERY IMPORTANT!.txt