C:\projects\leaf-xnet\Leaf.xNet\obj\Release\net45\Leaf.xNet.pdb
Behavioral task
behavioral1
Sample
LazyAIO/Lazy.json
Resource
win10v2004-20240709-en
Behavioral task
behavioral2
Sample
LazyAIO/LazyAIO Cracked.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral3
Sample
LazyAIO/LazyAIO Cracked2.exe
Resource
win10v2004-20240709-en
Behavioral task
behavioral4
Sample
LazyAIO/Leaf.xNet.dll
Resource
win10v2004-20240709-en
Behavioral task
behavioral5
Sample
LazyAIO/key.cto
Resource
win10v2004-20240709-en
General
-
Target
LazyAIO.zip
-
Size
10.9MB
-
MD5
d343ed918a5d3a4f60651101a1844efc
-
SHA1
64610a0aa9fa5093a37e7a4dc5141256afb963ff
-
SHA256
9c190b50fd860c35aa0feb917cc896fdaafaffbc3f3b2f13c4aa87f02c027b09
-
SHA512
06df5b518291d7821ec2a21047799a3ed25db2555282ffbe8e1b929e6534430cdb79fc6f78ab5d4ee420090dc9f498f239d1e7d4b22ca8c790828519edb6ca2a
-
SSDEEP
196608:p8n5yLwEK1pFzQAifiu8PncPyn6fLwEK1pFzQAifiu8PncPlGHj:pWxEK13QsYA7EK13QsY8D
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 2 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule static1/unpack001/LazyAIO/LazyAIO Cracked.exe agile_net static1/unpack001/LazyAIO/LazyAIO Cracked2.exe agile_net -
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/LazyAIO/LazyAIO Cracked.exe unpack001/LazyAIO/LazyAIO Cracked2.exe unpack001/LazyAIO/Leaf.xNet.dll
Files
-
LazyAIO.zip.zip
-
LazyAIO/Lazy.json
-
LazyAIO/LazyAIO Cracked.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 13.9MB - Virtual size: 13.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
LazyAIO/LazyAIO Cracked2.exe.exe windows:4 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 13.9MB - Virtual size: 13.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.enigma1 Size: 1.0MB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma2 Size: 280KB - Virtual size: 280KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
LazyAIO/Leaf.xNet.dll.dll windows:4 windows x86 arch:x86
dae02f32a21e03ce65412f6e56942daa
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
mscoree
_CorDllMain
Sections
.text Size: 127KB - Virtual size: 126KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
LazyAIO/key.cto