��S��7M|(y��F�IX�"^%g�/�R��̵'�Q������ʎ�g ���،w�2\� �Q�0�?}�8"T3�)�O���n���ҫO���⌂K�@��P�Bۭ�5�\3~Ϝ+R���*����������+c����+�[�ɮ��Zϡ�T�����*?��G0�)-į0nߠc��y3?��H��#L$����["�t�ZF�_�p������]�5�=��2���Ϡ������Y��qX�E��`�:�����!��/�#�����,�V㭗oF8R���K=� K5����i��䆱��`�μj��x�:λ|�]���Kv�Ţ��{�^�G.��W�E��A��.l���94�=U�yL}f��ˑ��o�j/(�jT�Tȇ$N�C�Xd)^D�.�� �HUB���^+�\���i<W�t.���=������A_���ۀ���W���3��Jj��I`��+�(�Veo]�Y��S%�py�F�> |8�<�@٪Z�cE'��fuymm��H�������v:g�R#�v��\E��Ոw7E�v/�J����,����_Op����CY�$���W8>^/�ٵ��������q�б�Bh�>i \R^_I�0�a�yJ����酔(GZ>���f����-��/�բ�r��3/ԫG�)�į3�6��:}�z�x���2�s��`��*��č��W ����Ł3��;�܃��2��>}�P�/�r���kϕ9E���2�y^�J��������l��M0z`8��䊩��˙t4����ͧ�/+~�+n�'8��.��^BՎ�MG\?Ѡ|�]��e,r(�Fڦٟ-�H���u�>��_ECE`�^�b<t*�z�<!��*���7��ڿm�*�����ĩɷ��|�Hz��hDb�*� �q&n1������?��:�y$108�a�?Ņ� �$Gw'yu���b��AHK�Q��H�K�|(䨻VW�2�~�)��#`2�!*����?Կ�`Z�<?lsy���ԑ��/��_8�[�_yG�zZ8��f��]��i����Du lw�9]~{�<,�����������U�L#��Sk{�X,�'yΌFC�_@ocY/暮3f֓Gރ��佋�ᷬI�U]���dM��4宛�6(���F Z�P�S8Ὦ�*��2r;1 ���O(%��̯�S�>2����T��u����������A��n��Íek��x�/=0,�h�Qn )��rRm�Q=Z�8������M廫}B�U��� y��F=@$��q��1T����f'��U�>��b�4uEg�:1dez �0�z�y2�N��"+����p�h��s}���u)����o��R3��� <Z��|�E��c kQ�h�� 05��J�//���1�r��B`�����3W�s��s���;h R��Ψ�tV.0ZKJ��O�G��&4�����Iˏ/��%�f�(���m�����f𬌔G�}T��I�(�+ʁ����p����O�G<<����r�#���!e�Mg�q`��G��u��|Wa�k���GX��1[ 2#;S�]>�Q];�6�BM,]�>�M�hS��0~�u��VH�ɷ��=t�z�S��ޖ�R�-�.��D��It����Uo'�8�O=WV/dN�?+����aMYzdw�Y�i�}�L����O[�]G�k�}XI��J)L$8�i��,�$��I��o$&��ˆ�nb8�։��RsS$}�&jC�Db�A��|�"�J�=/�?Q�D�*t�M�:ñ{�����7%/:*��Zl)�[4�5X.It^��x.<�Fj�A��~.�ߛJ膸��U}�RI��➢HV;4s��3��@�t2�*�^2�u\���4�H��d��/��&k mBc $�K�mu����5_��[$����^�s��L�°j��j"�z�m�cUd�jz�D.�A�pl���+}�XT�ۢB�s���~����1|$a���֏A�eVgaY8�42� ���fF�����t��!>"���;�)=.���Ҹ<O���T���mh2�l�t�8�t�܃6I�f84H���d��_���:k��� ���}@0$�7i.���e9_^���T��E�7�Om3XIF3TDcb��=��=0�'<��E�'��w*���h�)�ij�����>��n���Ȳ*RZj�]/��p�R�l���q��� <`?�@V��ퟖ���RQ�=Z�u��l_l�K!�!����mdX��T��hB>z���T���Mȃ8��) J�AyC ������b`��)!��k>����L"�&��p�m.�Hpc/&��Ӆ?�}�I*��~g��<�J nҪh�V4��|�B�\����q�m-��M�⡛ˈDO�5�����QsV��;�6j3�TJr]F36��O; �GaN-����@E�a���E�-X4B"�'P�_)]u?�EY�iۛ��|��0OJ���\��vڼ��%5�d��9#�5�&D^ /�W�Rh|�sL�h�[���Ǩv���]������K��O����0���̹P�tey�psP�{�� ��4}�M#bш�E>NJ �00?/�`��\;��1�Eۡ����s }BW,���"Lڵ�����N��iʾ���p��&Y�P��� f�j�6�F2Q����'0����h�b��ĸe� /=���@ɳ��fe��ɡC�Lsrk�j������s"��cTO�x�;~���[�?�l��*�b�����/Yq��g-��r�(������w�j�t�l��~���u��)���v�C�J@��<bݱ��Tj2��:ϡ�B��4u8�u�z^ֻ3N%6�%�I���|21�S�p)>��[*����������ŀ��d7����`l(P����WAC������~�Gfј����[A%_~��#7��S�4��y� �M_���Ȃ��\~�¯a����cWp��P��K3�81�0���B;,�FV}�x`ҝ��Ȣn��H�\<!d2(�bu�5b�H� wW4cOB��I9��gmJ��K�{{��j4u����9 �ItY�1�����B@�1Iq�\
Static task
static1
Behavioral task
behavioral1
Sample
MPayne3+9Tr-LNG/MPayne3+9Tr-LNG.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
MPayne3+9Tr-LNG/MPayne3+9Tr-LNG.exe
Resource
win10v2004-20240802-en
General
-
Target
b22d4813f9fe4b5af3aded133ac1bcbc_JaffaCakes118
-
Size
2.2MB
-
MD5
b22d4813f9fe4b5af3aded133ac1bcbc
-
SHA1
a857458c78cd42493f8dc967e1123c7151367f68
-
SHA256
6ff12031e831c715031f8afd618a51882c1787279eed668b84a750f802ea4f73
-
SHA512
adb9cb8a4d0c7411b060647947743439aa78f0870bbf1af72b6ee16f0dc0b70b7214aa18eb9dac85d5502a9de98d9afc5eaa52f14e8bb92f1acb8af538811b95
-
SSDEEP
49152:R/ts+2/7U+oFXpgue72jdR3tA/fvWI8dXJKp2m:Ls+6PcXpgueY73SX+oz
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/MPayne3+9Tr-LNG/MPayne3+9Tr-LNG.exe
Files
-
b22d4813f9fe4b5af3aded133ac1bcbc_JaffaCakes118.rar
-
MPayne3+9Tr-LNG/MPayne3+9Tr-LNG - I.N.F.O.txt
-
MPayne3+9Tr-LNG/MPayne3+9Tr-LNG.exe.exe windows:4 windows x86 arch:x86
da5b7fc4dd67a75d5b2015a42f5c8112
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord578
kernel32
SizeofResource
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutWrite
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.2MB - Virtual size: 2.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
MPayne3+9Tr-LNG/VERY IMPORTANT!.txt