Ha����2L�Qx��d��rH<���q�^ij����,��d4����� �s����֚� �S�]0��_�����b{�jT�Y�!xMw�k�EM/q��ҧ�� ���Ҍ�\,8����:@&�C�l!v孕ھVNUuL�� ���Y�&�J8��M�cgH���DS��MĽ(��i.�������G���Ƚ9)�Χ���2hYq$@�M��t�d�E�'�m�,O{Ϣ���! N1+���U�4�0$�I�fs����;�+\A�ne)+b�]�����ߜ�d�o�J����3�Dt�U���W '�y�O�W�s4>nH�=��)z�6�ҩ}�-�P@%��SeD���俖��P@��p�w�m<�L����>Tbw7a��A%��=��#aX:S'�¾��62GCF_ �5�0k��z*��N�w���D#|Y!ʷ�+zZr�N�H���W]K�JX9��φ8�9�I0��,_�^(���X{lA����gp���R�aYr���d�Q+�TG�L)h��X��\(.�r��}ZUŒdE�f�1/ �\�4�Bq�s�ӎ+"���(�n�k9�/��D�����z��j;f~Q���c�Xې��ڲ�� I��֑B�&Y�&܍*�=v���t3 ���#cU�`ݛh�� ,�������ZdĄ:#s>���'�+^n8L��eAr����4@m�DZ����̂�и���<%��0�4Vc7��V����At�T|��������AB�%=B�s{��H�m�l��d��N�I�w������ �>s��n�x<g5���n��b��mL:�������/ߝ���"y����4;��g�e�o>� ���H��RY\Od�Z�@��KuY.�4q��t�<���<�'#��%��X����%E�Pm �3���c}��9翾��b��3e}��/3��wFH������ �_\�堼s��X��=w���.����C ��'���#{���2�w^H?ʼM����2����H�/���e�ć����&4aYvFm���d�/�?ɄK�H<^pȸ*�L6��$�meRL/\�������L����N�n*�?�u�����������6k�ו�V��r=���ȴjB,��&܆�W���Ź����ʞ�Q��.1Ag��U'�C����eJG�y��eɗ����k���K�b��/:TZ��O�ƍĄ)� .��8�}���\(\�z}]����k��KNsWʰ;�����˞N�tn/W���ū�LRGD87��F�>�IR��*M,B���u��F߭U �'V�8���x�dϥj�5v��T�b �р�W1g�����\�.z��)d�-��� Zق+��gf�jpb`�#-�I7����E���K��0��X�X0Q�� ���J�'����=�RЍ,b�3�\�"��R"���ţ�;���P$�����sc���$��!���� \������T��S"�98'��G!]�XR<�ȍPE"��bw��yM�U[1�������d���(R�ڍ����+&�)6/}�)˧Y�� b�P�w�f� u�s�YMR�R��%Uh���b?���� s35��ũO������&�fkX��*P��9�%P�r�����v�����w{����Gd(P�n�i�?q�+C� s������h�;��R���@�ꮽjw�7�F08���������~$Ϻ+$�P�|��~��`z,�.��"/�٩�x�I���X�үZInb��GL&�ZNGʲ��$��=5Ԗ;�'�g��kӖ�©/l�О�r����&M��8�%�ZX�t*K�+e�J�ԗ�k'cI\O��cD�پ��\��J ��_��o~b�p���|v�DP@��(�1��R���F䚸�2傦]^$Q��mB�3�d��6&�-%��,�� L��w��$�K}/6Q�n���W/����Uu��"G��2S���k�q0�נ�� jL�D�|���T��[���x�:��/��tz����SF2��bY��s�vf����ݯyZg����QgU�8�T�������LΈ f#�����fe�|��"QO}�����`�o���[�8(m`��M�������ʣ�|�:Cܼ|Rcd��@�,�G�K�:�C�DS����eN�a�3f���k� ���|�������_TKO ϙ��G����{6KUw�t�D�}��EG�o�=�3 �����g5a�L�wP�L�$Hn��M�c�/DU��$�ܟ�#�I )Z�<Z�Z�Ăk��bSpH+��}� �h0�~���&�m�����vY�[f��L8|��n��K3}6%�ё���%�llV�lE�E�uR�5Y2�]�=J@�tY�7�{�s��� ~���Y�¸=�L� P�uݩ^�o��N���5���h}� 3�|9.KQ��쁼���D�4����`�c�Z��/]wBk���� �z���B��J���O�� )��]����Y"�����`�v�K�y�l���cf���BZ�bo�--w4 x��S��v�\e�x)���A��ɯ�6�[�Zn�O�ӧ�A�����~d8 �H_=����8�� �e�ߵ���#�{��oR� ���K]�ʒ�����)Ѕ��]�v%����\��{��6�W�i����5�����o [B,�'\G�O"P��]�fLM���r�'��I�b瓟Q5���i���0^�Fk��J�lH�9�E[mz#1��@�|�#��J``�s�\⛪$�(:~6(J\� ��r���`"AE�JB9Q�R����#@���+�Q�*姨Wap2պ�ztX �^�oX�ϣ2����(�{G���VwQ���nɈ��Ղͱb�Κ�)��d����/�^e A�����x�����hgG����;���USh�U�8'�MV�οa�z��{���)$��C�\�cV��M��֫�&�hn���r�y h�j�����55W6 ��ԩ�^�JW�Z/`���#N�4��}��_Mw|��U�r2����S�U�����Od:jݏ������б�C����m��$;S'�?��62J<���{�L����[:����8���z ��
Static task
static1
Behavioral task
behavioral1
Sample
Brink+13Tr-LinGon/Brink+13Tr-LinGon.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Brink+13Tr-LinGon/Brink+13Tr-LinGon.exe
Resource
win10v2004-20240704-en
General
-
Target
29bf2d35bbe6054fe3093413e38d2530_JaffaCakes118
-
Size
2.0MB
-
MD5
29bf2d35bbe6054fe3093413e38d2530
-
SHA1
12bd6922b329f072c694f755454f5a7ada98c56b
-
SHA256
579566424fe171d878e5fc5efb8e9b1e58a727ec9881d7379a3a69933fca75aa
-
SHA512
6f809d97f74c44defc69b609e323d8713c4e21d6eb17acbe922c7329237124fb848d38c748f770d7c6cc94e1b62c1b9e3463d48cc3022bb9313cb319a8b19c6f
-
SSDEEP
49152:EWu65ocS0VGCxnxrri7wVC9EkMi5x5PbO0TqOgHg9w+XYHV/oKB1S:jJxrri7w3zi5x5PbbqOg6w+XuV3Bk
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Brink+13Tr-LinGon/Brink+13Tr-LinGon.exe
Files
-
29bf2d35bbe6054fe3093413e38d2530_JaffaCakes118.rar
-
Brink+13Tr-LinGon/Brink+13Tr-LinGon - INFO.txt
-
Brink+13Tr-LinGon/Brink+13Tr-LinGon.exe.exe windows:4 windows x86 arch:x86
e8b5de098d22a591f16eb2168c3168d9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaObjSet
kernel32
SizeofResource
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutReset
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.0MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ECrypt0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ECrypt1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Brink+13Tr-LinGon/VERY IMPORTANT!.txt