LagoFast_windows_1[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

LagoFast_windows_1.exe
Size

79.6MB
MD5

56faed0b7aa95f3da2b4b42cc565bd96
SHA1

6f9f6cc6568c488d12785f2181dd41baf8328276
SHA256

99fab2f387d199832ecdbd0438c529c5969e3271da6a64d213ea20616322f261
SHA512

079b5584ed51f3c3fb5fddcb6098931ba1eb5cc986c2f32e7f6f3ff5d6cb8aa84901931e8e313dad76eb401883f5cc83bf8048f0af00d1c17ad6a0e6b0397bb8
SSDEEP

1572864:WD2LXMgl6jcz/6VOUBjz97XbnfHJZO4J5elpXjcjD:VlrYZXTl5eDTmD

Score

1^/10

Malware Config

Signatures

Files

LagoFast_windows_1.exe
.exe windows:6 windows x86 arch:x86

4db42a69f88f758095401645f544e606

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29-04-2021 00:00

Not After

28-04-2036 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:ca:d1:04:8d:76:40:f6:19:03:1a:46:9c:0b:08:fe
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

07-03-2022 00:00

Not After

05-03-2025 23:59

Subject

SERIALNUMBER=3067338,CN=JUNYUN LIMITED,O=JUNYUN LIMITED,L=SAN PO KONG,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14-07-2023 00:00

Not After

13-10-2034 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23-03-2022 00:00

Not After

22-03-2037 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-08-2022 00:00

Not After

09-11-2031 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

9f:0f:cc:a4:fe:6f:b2:cf:13:07:04:2f:c7:de:3d:6e:c6:bd:cc:26:7e:8d:32:14:6a:2b:73:ea:9e:c4:02:f9
Signer

Actual PE Digest

9f:0f:cc:a4:fe:6f:b2:cf:13:07:04:2f:c7:de:3d:6e:c6:bd:cc:26:7e:8d:32:14:6a:2b:73:ea:9e:c4:02:f9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Program Files (x86)\Jenkins\workspace\LagoFast_New\Installer\Release\Installer.pdb

Imports

advapi32

RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA

ws2_32

htonl
ioctlsocket
listen
accept
sendto
recvfrom
freeaddrinfo
getaddrinfo
WSAStartup
WSAIoctl
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
ntohl
WSACleanup
WSAGetLastError
__WSAFDIsSet
select
gethostbyname
WSASetLastError
recv
send
bind
gethostname

crypt32

CertFreeCertificateContext

wldap32

ord46
ord211
ord60
ord45
ord50
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord143

kernel32

DisconnectNamedPipe
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
Sleep
GetCurrentProcessId
TerminateProcess
OpenProcess
DecodePointer
lstrcpyW
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
DeleteFileW
EnterCriticalSection
LeaveCriticalSection
GetShortPathNameW
FreeResource
GetModuleFileNameW
LoadResource
LockResource
SizeofResource
FindResourceW
GetPrivateProfileStringW
GetUserDefaultUILanguage
CreateFileW
GetDriveTypeW
GetFileAttributesW
GetLogicalDriveStringsW
RemoveDirectoryW
SetFileAttributesW
WriteFile
GetTempPathW
SetHandleInformation
CreatePipe
WaitNamedPipeW
GetCurrentThreadId
CreateProcessW
WritePrivateProfileStringW
LocalFileTimeToFileTime
SetFilePointer
SetFileTime
SystemTimeToFileTime
FreeLibrary
GetProcAddress
LoadLibraryW
MoveFileExW
GetFileSize
SetEndOfFile
GetStdHandle
GetFileInformationByHandle
FindClose
FindFirstFileW
FindNextFileW
SetLastError
GetTickCount
GetModuleHandleW
GetModuleHandleA
VirtualAlloc
VirtualFree
FormatMessageA
GetTickCount64
SleepEx
VerSetConditionMask
GetSystemDirectoryA
LoadLibraryA
VerifyVersionInfoA
WaitForSingleObjectEx
GetFileType
PeekNamedPipe
WaitForMultipleObjects
OutputDebugStringW
OutputDebugStringA
ReadFile
CreateDirectoryW
GetLastError
RaiseException
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
GetCurrentDirectoryW
CloseHandle
lstrcmpiW
IsValidLocale
GetFileSizeEx
FlushFileBuffers
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetEnvironmentVariableW
GetFullPathNameW
GetModuleHandleExW
ResumeThread
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualProtect
LoadLibraryExW
FreeLibraryAndExitThread
DuplicateHandle
GetCurrentProcess
SwitchToThread
GetCurrentThread
GetExitCodeThread
TryEnterCriticalSection
FormatMessageW
GetStringTypeW
FindFirstFileExW
GetFileAttributesExW
SetFilePointerEx
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetCPInfo
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetACP
GlobalUnlock
GlobalLock
lstrlenW
ExitProcess
MulDiv
LocalFree
GetVersionExW
GlobalAlloc
GetLocalTime
lstrcpynW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes

user32

OffsetRect
GetWindowRect
SetWindowPos
SetWindowLongW
GetWindowLongW
KillTimer
SetCursor
InflateRect
UnionRect
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
CreateWindowExW
IsWindow
DestroyWindow
IsIconic
IsZoomed
CharNextW
SetFocus
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetClientRect
GetCursorPos
GetParent
MapWindowPoints
GetSysColor
IntersectRect
IsRectEmpty
PtInRect
GetWindow
LoadImageW
MonitorFromRect
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
SetWindowRgn
MessageBoxW
EqualRect
UpdateLayeredWindow
MoveWindow
IsWindowEnabled
GetWindowRgn
CharPrevW
DrawTextW
FillRect
SetRect
CreatePopupMenu
DestroyMenu
EnableMenuItem
AppendMenuW
TrackPopupMenu
CreateCaret
GetCaretBlinkTime
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
UpdateWindow
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
wsprintfA
DrawTextA
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
SetForegroundWindow
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
SetTimer
IsWindowVisible
PostQuitMessage
ShowWindow
PostMessageW
wsprintfW
MonitorFromWindow
GetMonitorInfoW
CharUpperW
DefWindowProcW
ScreenToClient

gdi32

SetTextColor
SetStretchBltMode
TextOutW
StretchBlt
GetObjectA
SetBkColor
SetBitmapBits
GdiFlush
CreatePatternBrush
SetBkMode
GetTextExtentPointA
MoveToEx
CreateCompatibleBitmap
BitBlt
ExtSelectClipRgn
SelectClipRgn
LineTo
GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateSolidBrush
CreateRectRgnIndirect
CreatePenIndirect
CombineRgn
CreateDIBSection
PtInRegion
CreateRectRgn
CreateRoundRectRgn
SetWindowOrgEx
GetObjectW
GetTextMetricsW
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileW
CloseEnhMetaFile
SelectObject
SaveDC
RestoreDC
Rectangle
SetLayout
GetLayout
SetViewportOrgEx
GetBitmapBits
RemoveFontMemResourceEx
AddFontMemResourceEx
GetStockObject
GetDeviceCaps
CreateCompatibleDC
CreateDIBitmap
CreateFontIndirectW
CreatePen
DeleteDC
DeleteObject

shell32

DragQueryFileW
SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW
SHGetFolderPathW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHGetSpecialFolderLocation

ole32

CLSIDFromString
CLSIDFromProgID
CreateStreamOnHGlobal
ReleaseStgMedium
OleDuplicateData
DoDragDrop
OleLockRunning
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

VariantInit
VariantClear
SysAllocStringByteLen
SysStringByteLen
SysStringLen
SysFreeString
SysAllocStringLen
SysAllocString

shlwapi

PathRemoveFileSpecW
PathRemoveBackslashW
PathIsRootW
PathFileExistsW

comctl32

_TrackMouseEvent
ord17
InitCommonControlsEx

gdiplus

GdipCreateFontFromDC
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipDrawImageRectI
GdiplusStartup
GdiplusShutdown
GdipAlloc
GdipGetPropertyItem
GdipCreatePath
GdipDeletePath
GdipAddPathLine
GdipAddPathArc
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipCloneImage
GdipDisposeImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipDrawRectangleI
GdipDrawPath
GdipFillRectangleI
GdipFillPath
GdipFree
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 279KB - Virtual size: 279KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 78.1MB - Virtual size: 78.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4db42a69f88f758095401645f544e606

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

02:ca:d1:04:8d:76:40:f6:19:03:1a:46:9c:0b:08:feCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

9f:0f:cc:a4:fe:6f:b2:cf:13:07:04:2f:c7:de:3d:6e:c6:bd:cc:26:7e:8d:32:14:6a:2b:73:ea:9e:c4:02:f9Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

ws2_32

crypt32

wldap32

kernel32

user32

gdi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

imm32

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 279KB - Virtual size: 279KB

.data Size: 17KB - Virtual size: 26KB

.rsrc Size: 78.1MB - Virtual size: 78.1MB

.reloc Size: 63KB - Virtual size: 62KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

02:ca:d1:04:8d:76:40:f6:19:03:1a:46:9c:0b:08:fe
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

9f:0f:cc:a4:fe:6f:b2:cf:13:07:04:2f:c7:de:3d:6e:c6:bd:cc:26:7e:8d:32:14:6a:2b:73:ea:9e:c4:02:f9
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 279KB - Virtual size: 279KB

.data
Size: 17KB - Virtual size: 26KB

.rsrc
Size: 78.1MB - Virtual size: 78.1MB

.reloc
Size: 63KB - Virtual size: 62KB