LagoFast_windows_1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

LagoFast_windows_1.exe
Size

72.7MB
MD5

7e8e7d05bcb439b077fb6d509d179dcb
SHA1

1aa871e43902849100908718c4f97455bad0cd6d
SHA256

80dfe4085b917d92a830fa06ce62a2e0ccd94a2c4cc7391888cb411612fef766
SHA512

a5c107b4d6578850b3945157a29dda05b01fb205447d6d662f25417601e9a18a7814c693d287497c3749ef5816e18a132af19b3a56ad52ce3996a4803528ffc7
SSDEEP

1572864:qW2LcV+fvEtar/NXQixYQRYVZIECd0qF6BAM+fjaNm:DcnXjNXZxYQR0ILzuNm

Score

1^/10

Malware Config

Signatures

Files

LagoFast_windows_1.exe
.exe windows:6 windows x86 arch:x86

847cacc416e4c07a6f0fae80561518cd

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:ca:d1:04:8d:76:40:f6:19:03:1a:46:9c:0b:08:fe
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

07/03/2022, 00:00

Not After

05/03/2025, 23:59

Subject

SERIALNUMBER=3067338,CN=JUNYUN LIMITED,O=JUNYUN LIMITED,L=SAN PO KONG,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

a9:ad:5e:fc:f0:80:32:c8:12:0d:aa:d5:12:23:db:25:21:9e:81:b1:a2:40:09:ba:19:4c:6b:ca:77:55:6b:5a
Signer

Actual PE Digest

a9:ad:5e:fc:f0:80:32:c8:12:0d:aa:d5:12:23:db:25:21:9e:81:b1:a2:40:09:ba:19:4c:6b:ca:77:55:6b:5a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Program Files (x86)\Jenkins\workspace\LagoFast_Create_Channel\Installer\Release\Installer.pdb

Imports

kernel32

GetStdHandle
GetFileInformationByHandle
FindClose
FindFirstFileW
FindNextFileW
SetLastError
GetCurrentProcessId
GetTickCount
GetFileSize
GetModuleHandleW
GetModuleHandleA
VirtualAlloc
VirtualFree
SetEndOfFile
MoveFileExW
GetProcAddress
FreeLibrary
SystemTimeToFileTime
SetFileTime
SetFilePointer
LocalFileTimeToFileTime
GetCurrentDirectoryW
WritePrivateProfileStringW
CreateProcessW
GetCurrentThreadId
Sleep
CreateEventW
WaitForSingleObject
SetEvent
WaitNamedPipeW
DisconnectNamedPipe
CreatePipe
LoadLibraryW
SetHandleInformation
GetTempPathW
WriteFile
SetFileAttributesW
RemoveDirectoryW
ReadFile
GetLogicalDriveStringsW
GetFileAttributesW
GetDriveTypeW
DeleteFileW
CreateFileW
GetUserDefaultUILanguage
GetPrivateProfileStringW
FindResourceW
SizeofResource
LockResource
LoadResource
GetModuleFileNameW
FreeResource
GetShortPathNameW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
WideCharToMultiByte
MultiByteToWideChar
lstrcpyW
lstrcmpiW
OpenProcess
TerminateProcess
DeleteCriticalSection
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DuplicateHandle
WaitForSingleObjectEx
GetCurrentProcess
SwitchToThread
GetCurrentThread
GetExitCodeThread
GetStringTypeW
FormatMessageW
FindFirstFileExW
GetFileAttributesExW
SetFilePointerEx
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetCPInfo
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetACP
GlobalUnlock
GlobalLock
lstrlenW
ExitProcess
MulDiv
LocalFree
GetVersionExW
GlobalAlloc
GetLocalTime
lstrcpynW
IsDebuggerPresent
ResetEvent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread
LoadLibraryExW
VirtualProtect
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitThread
ResumeThread
GetModuleHandleExW
SetEnvironmentVariableW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
GetTimeZoneInformation
GetConsoleMode
ReadConsoleW
IsValidCodePage
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
FlushFileBuffers
GetConsoleCP
WriteConsoleW
HeapReAlloc
HeapAlloc
GetLastError
RaiseException
CloseHandle
DecodePointer
OutputDebugStringW
OutputDebugStringA
CreateDirectoryW

user32

RegisterClassExW
GetClassInfoExW
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
SetWindowRgn
MessageBoxW
EqualRect
UpdateLayeredWindow
MoveWindow
IsWindowEnabled
GetWindowRgn
CharPrevW
DrawTextW
FillRect
SetRect
CreatePopupMenu
DestroyMenu
EnableMenuItem
AppendMenuW
TrackPopupMenu
CreateCaret
GetCaretBlinkTime
HideCaret
ShowCaret
CallWindowProcW
GetCaretPos
ClientToScreen
UpdateWindow
SetWindowTextW
IsRectEmpty
GetWindowTextLengthW
BeginPaint
DrawTextA
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
SetForegroundWindow
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
IsWindow
CreateWindowExW
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
LoadCursorW
UnionRect
InflateRect
SetCursor
ReleaseDC
GetDC
ReleaseCapture
SetCapture
RegisterClassW
DefWindowProcW
LoadImageW
GetWindow
SetCaretPos
IntersectRect
GetKeyState
GetFocus
GetActiveWindow
SetFocus
CharNextW
IsZoomed
DestroyWindow
wsprintfW
ShowWindow
PtInRect
GetSysColor
MapWindowPoints
ScreenToClient
GetCursorPos
GetClientRect
InvalidateRect
GetUpdateRect
GetWindowTextW
PostMessageW
CharUpperW
GetMonitorInfoW
MonitorFromWindow
MonitorFromRect
GetParent
OffsetRect
GetWindowRect
SetWindowPos
SetWindowLongW
GetWindowLongW
EndPaint
PostQuitMessage
IsWindowVisible
SetTimer
KillTimer
IsIconic
wsprintfA

gdi32

RemoveFontMemResourceEx
Rectangle
RestoreDC
SaveDC
SelectObject
CloseEnhMetaFile
CreateEnhMetaFileW
GetEnhMetaFileHeader
PlayEnhMetaFile
GetTextMetricsW
GetObjectW
SetWindowOrgEx
CreateRoundRectRgn
BitBlt
PtInRegion
CreateDIBSection
CombineRgn
CreatePenIndirect
CreateRectRgnIndirect
CreateSolidBrush
AddFontMemResourceEx
GetClipBox
GetTextExtentPoint32W
LineTo
SelectClipRgn
ExtSelectClipRgn
SetBkColor
SetBkMode
GetStockObject
GetDeviceCaps
DeleteObject
DeleteDC
CreatePen
CreateFontIndirectW
CreateDIBitmap
SetViewportOrgEx
GetLayout
SetLayout
StretchBlt
SetStretchBltMode
SetTextColor
GetObjectA
MoveToEx
TextOutW
GdiFlush
CreatePatternBrush
GetTextExtentPointA
GetBitmapBits
SetBitmapBits
CreateCompatibleDC
CreateCompatibleBitmap
GetCharABCWidthsW
CreateRectRgn

advapi32

RegQueryValueExW
RegDeleteValueW
RegCloseKey
RegOpenKeyExW
RegCreateKeyExW
RegSetValueExW

shell32

SHGetSpecialFolderLocation
CommandLineToArgvW
SHGetSpecialFolderPathW
SHGetFolderPathW
SHBrowseForFolderW
ShellExecuteW
DragQueryFileW
SHGetPathFromIDListW

ole32

DoDragDrop
OleDuplicateData
ReleaseStgMedium
CoUninitialize
CoInitialize
CoCreateInstance
CreateStreamOnHGlobal
OleLockRunning
CLSIDFromProgID
CLSIDFromString

oleaut32

VariantClear
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
SysStringByteLen
SysAllocStringByteLen
VariantInit

shlwapi

PathIsRootW
PathRemoveBackslashW
PathRemoveFileSpecW
PathFileExistsW

ws2_32

gethostname
gethostbyname
WSAStartup

comctl32

_TrackMouseEvent
InitCommonControlsEx
ord17

gdiplus

GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipDrawImageRectI
GdipGetPropertyItem
GdiplusStartup
GdiplusShutdown
GdipAlloc
GdipFree
GdipCreatePath
GdipDeletePath
GdipAddPathLine
GdipAddPathArc
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipCloneImage
GdipDisposeImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipDrawRectangleI
GdipDrawPath
GdipFillRectangleI
GdipFillPath
GdipCreateFontFromDC
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize

imm32

ImmReleaseContext
ImmSetCompositionWindow
ImmGetContext

Sections

.text
Size: 940KB - Virtual size: 940KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 224KB - Virtual size: 224KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 71.5MB - Virtual size: 71.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

847cacc416e4c07a6f0fae80561518cd

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

02:ca:d1:04:8d:76:40:f6:19:03:1a:46:9c:0b:08:feCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

a9:ad:5e:fc:f0:80:32:c8:12:0d:aa:d5:12:23:db:25:21:9e:81:b1:a2:40:09:ba:19:4c:6b:ca:77:55:6b:5aSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

ws2_32

comctl32

gdiplus

imm32

Sections

.text Size: 940KB - Virtual size: 940KB

.rdata Size: 224KB - Virtual size: 224KB

.data Size: 17KB - Virtual size: 25KB

.rsrc Size: 71.5MB - Virtual size: 71.5MB

.reloc Size: 53KB - Virtual size: 53KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

02:ca:d1:04:8d:76:40:f6:19:03:1a:46:9c:0b:08:fe
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

a9:ad:5e:fc:f0:80:32:c8:12:0d:aa:d5:12:23:db:25:21:9e:81:b1:a2:40:09:ba:19:4c:6b:ca:77:55:6b:5a
Signer

.text
Size: 940KB - Virtual size: 940KB

.rdata
Size: 224KB - Virtual size: 224KB

.data
Size: 17KB - Virtual size: 25KB

.rsrc
Size: 71.5MB - Virtual size: 71.5MB

.reloc
Size: 53KB - Virtual size: 53KB