���&y@�Z�l�.�2�1���z�ʦi�������y��,\-�� _���Ya�i�=�5�yB�2��GO7ў���78��B;�f$�l��yX#5�F��Zl�(�H���a�`yq��L�k�m%��>�_qzo�02!��iF�bH���̋���D����γ^�劋������@��|��3����tτg����P���jd�B]��Nt�Zx�Q�[0_���`�����@1�����J� E^[�;`x#�xW[�uXf?��а��m����H�����H�ֲ�� {�j����1t������L�����/aq��Go�ڭF�����(@�������)a���10�7��3>P5;�e�jcxh�HuU�'~��y�XZ=��}e���S�τ�EK��|>�*7����up���&y������ �� �D����T���Jc�Ka���Z�8:ZS��l�z溭bC���~�S�-���S3�����F�ױ�H��M�i����"��^`e�0�`�Fþdt�o�]�+rʖ����|�v�p������|ץj\�w�[>�c�s�O}*��7���'�R��cl.x-[�J�P���z����6%�������=�(-����0 l*3����J3�`!�+]�2e������I�KJm���TY�,&2��)A�O�5�7��:�Ǭ��<d~HM�j{}��B��)��)㗋������п)qxҗ$^�e@�%������&��w>3j�����ð��z�j�L_���8Veފ�����F���>ʌ���кI�?�t�mH�ß�u��1�w 8ٍaq�R�l���< 5gO�Qs����S��C��m㫍^{�Y�dZ&RFG�[<� ��͍�=�|��َ����k�t����a����)D +�K[k��3��n^m0�K��[ ���cs�2�c����д~������%�jݿ����4t��~Ϥ)�z���$Q��RL[���ª�L�*K]E>��q���]�*XrN�Kb�v�?�ZW���rȤq��V�d��K��:�\��5��gJV��4��f�;\n"V�`�L~�E���k���_T[�\�+Pp!B (�Ә���,l�?�:�Ȅrd�)G�e�C��.�'C) � �J�ֹb�����I +��P��5�<�� ��ƪ+��\�G%�n��b0��C �}ĻI{��ֆ������>���Y� e�@�\����l�(��7���)�W]S�28LwX,ľs%� f%e}< ?�Ӕ��bNL[��wC<�QQ�ۖ��ۨ G�{Ib*upm�M�x�*c�u���IбM��(�K ��Fr��b6����*�&�"�J}��"��a�2��!'1�$w���o��<1X G`36�IT<]��1�vI^:Y�"q& V{~���=��j���]/����Yg�nQ8��[�#lkl&���m5ȑ��LB=�~{!�=�������'����Z��^�gZ��δ)�M�l�2 7x�7x2��u��̞`:��{�ŹE3��G�GI6���8�!"l����=�(�j�]UC�F*ݸ��l$�����HϤ���p��u������k�K�V�s�� 9<s�B�T��8���sa}����5��&�Y4%O3�pc���`�އ�~�).�ad_�b��"�N����Ê��9������� �����-qE�?6"��"�,aA��m�dn�|ԥP��u���m3'ۭ�O�YA9��û�0Sg��"���b��;�}Eٓ�QO���~� �,��65T�63�4^U����Ut���e����@�jF�clu���^��T&�g� ���.��z½���f��yCJӶX�@���g�>�ăa;,rq�����.)�g�uA�ύ}T��,����T!� q�3�Ϣ<kT7������A��ҿ��BX�ac ��cn�:����i��'�Orl��B'T�d%� �+R�A@G�D�%��'��bg�Q���d-sK��l�Ŕ+� ����ؗ���CJL@߮\n�l2 ��D�� ����d�D��8V]���rwm�c-�iAh��~��(kڕ+���]R4�įt 0�� ��l����:� ��L��eB�%��x!y�]�FNA��W}vG3�.Ӆ�W..TH��>,sZ��nw� ̱Ӽ7�~[�������z40���=�H����lܓ��y�느r�(���.G��Rf� ����{�0n[�"ޡN��O�ܢ��էC�x�/��Ħ)q��d�D��I�Q�� ]ܵW��e�,����<�(�9g�@vT�gI���KP�)+p�(|g�>��u���&b�>臰Qp}s��ek�%@��y�;d�k<B͎��Gjl�%��$^���8J��ƬS�4�Y!Z����& Q�}�^�M�L��!�W�\8�,��B��4nb^Ͽ_ F�� �E>ڵA�D� cU� ��5��V�*t;ħ2�Q�>[=�F�נ3ֆ��Y��������Po�4 �Gz�W�qr�I�P蚼�7���:q̆[�P'����W�t����������C�/7)Ͽ�U�]��wI����*U�l��K^��e�]�o_���;�BR,r)�[]@O�"x �����ܱ$u�^�����@��p������FO���Uc*]�K^��˯�����ӔZ� �����#�g��I����:a�ӗ-�sNo8�]�qK�C`�SnK��(%s��Q�&L^��\YD�L]F��_!O�To;��j�0w��+�f㦔 P��c>���I�9�0��K����|�� ���_L�\��<^U��>�� �f ����-2Y ��� QJ�w��4�I����o�������Nq ��QPt-���la�Ʊ���L���u�s(�ς�^\�v�R߬�~� ȴ�Ydf�?��+[F�e�a��c���p4[X`������k?fzE�>>��Ð����V�h���#����guTF����>�,f�;�G&t[�ג%�_�>�b�&w�� $Iң���DJ�&�^��ZV�_!e7��̕jo���E�� ���b�By�[ړT���#����D:���>���|IE@�s^D6"}!er@�@��Hp�_�a��lIm-$��z�8�REf�LJ-i��I��#ݤ�&S��%��01M�I��$Frg4 ��ub=j��O����2��$�~f�ktW:j��A�1P/�=S<�G�B�#��������lj��6i�� I���vwL8VX�K�WL��.~ ��D��N����p!�t<��q��G�����=�p�+�~�%���]�<:�ڦ�,�p�<�Z� �ck����&��cc���/s��G�;/dkI��3���wn��Qq�5�L������C�����x���n �䃨��U��?r�8Ǘ@�F^g�{�RM�4[���o�� �#Eԥ�*��i{����*ڡn�# z���M?�\=�K$�,��Jo� ���������]HB���굒��Z��K�}bC�,L������ M��V�Zs�F̓�Ta
Static task
static1
Behavioral task
behavioral1
Sample
lianaCol.exe
Resource
win10v2004-20240226-en
General
-
Target
lianaCol.exe
-
Size
3.3MB
-
MD5
375e81677a2c6c3df738e982aa5f7657
-
SHA1
a8bb4c8fd3ab503c55c7ab5765183554f32e9065
-
SHA256
9a77ec2407fd3013b8a94326fb2d538cc608a1f23ccfa31377f54796408052e1
-
SHA512
2110faa2ce618d710003d66c6fca986894527de739a6dde452b52ce5cb9e30caea74fce4feba755a1fe79d986cbba8a3c417dce7aef6c6b0b106d8da14e5452f
-
SSDEEP
98304:9BMBx+1Au8e414+vYU1mU/VWYc3pugpL0gt3OI:96BLy414+vYGmU/Vm3xOI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource lianaCol.exe
Files
-
lianaCol.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Exports
Exports
Sections
Size: 215KB - Virtual size: 448KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 36KB - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1024B - Virtual size: 2.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 272KB - Virtual size: 11.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2.8MB - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE