LagoFast_windows_431[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

LagoFast_windows_431.exe
Size

3.1MB
MD5

b1460d980ababd023cb4d095819a0f16
SHA1

c0efbc49037daf0ff0f2ffb158de28e068ec000e
SHA256

59916f27cf820b39bba50895b8149fe212625a330c142038b16d3ee8de054df8
SHA512

1bdab15eaedd03829b1ebb4585fd5f2624e6cb07abce964ec065dfabf420290e9bad72ab1009768c15bed4153a99beac1234aac8549f97debd5362dc1691d6df
SSDEEP

49152:/P9d6oeu483BNxqUwTc4pS26URTQwBBqVpzZOBVon/FdM7OViNvVxxx+d+S8BQOc:X9d6oLN0g4pS2sVqtG

Score

1^/10

Malware Config

Signatures

Files

LagoFast_windows_431.exe
.exe windows:6 windows x86 arch:x86

9c504db2588dcf714f604af3dfec35cc

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

02:ca:d1:04:8d:76:40:f6:19:03:1a:46:9c:0b:08:fe
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

07/03/2022, 00:00

Not After

05/03/2025, 23:59

Subject

SERIALNUMBER=3067338,CN=JUNYUN LIMITED,O=JUNYUN LIMITED,L=SAN PO KONG,C=HK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302484b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d8:d6:85:b4:62:1f:0f:97:78:18:70:c1:1f:cb:ee:d3:9d:dd:97:0e:1d:4a:86:17:43:ca:1e:19:b2:32:8e:ce
Signer

Actual PE Digest

d8:d6:85:b4:62:1f:0f:97:78:18:70:c1:1f:cb:ee:d3:9d:dd:97:0e:1d:4a:86:17:43:ca:1e:19:b2:32:8e:ce

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Program Files (x86)\Jenkins\workspace\LagoFast_Create_Channel\Installer\Release\Installer.pdb

Imports

advapi32

RegCloseKey
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegQueryValueExW
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA

ws2_32

htonl
ioctlsocket
listen
accept
sendto
recvfrom
freeaddrinfo
getaddrinfo
WSAStartup
WSAIoctl
socket
setsockopt
ntohs
htons
getsockopt
getsockname
getpeername
connect
closesocket
ntohl
WSACleanup
WSAGetLastError
__WSAFDIsSet
select
gethostbyname
WSASetLastError
recv
send
bind
gethostname

crypt32

CertFreeCertificateContext

wldap32

ord46
ord211
ord60
ord45
ord50
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord143

normaliz

IdnToAscii

kernel32

DisconnectNamedPipe
CreateNamedPipeW
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
Sleep
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
CreateProcessA
OpenProcess
DecodePointer
lstrcpyW
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
DeleteFileW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemInfo
GetShortPathNameW
FreeResource
GetModuleFileNameW
LoadResource
LockResource
SizeofResource
FindResourceW
GetPrivateProfileStringW
GetUserDefaultUILanguage
CreateFileW
GetDriveTypeW
GetFileAttributesW
GetLogicalDriveStringsW
RemoveDirectoryW
SetFileAttributesW
WriteFile
GetTempPathW
SetHandleInformation
CreatePipe
WaitNamedPipeW
GetCurrentThreadId
CreateProcessW
WritePrivateProfileStringW
ConnectNamedPipe
LocalFileTimeToFileTime
SetFilePointer
SetFileTime
SystemTimeToFileTime
FreeLibrary
GetProcAddress
LoadLibraryW
MoveFileExW
GetFileSize
SetEndOfFile
GetStdHandle
GetFileInformationByHandle
FindClose
FindFirstFileW
FindNextFileW
SetLastError
GetTickCount
GetModuleHandleW
GetModuleHandleA
VirtualAlloc
VirtualFree
FormatMessageA
GetTickCount64
SleepEx
VerSetConditionMask
GetSystemDirectoryA
LoadLibraryA
VerifyVersionInfoA
WaitForSingleObjectEx
GetFileType
PeekNamedPipe
WaitForMultipleObjects
ExpandEnvironmentStringsA
OutputDebugStringW
OutputDebugStringA
GetTempPathA
ReadFile
DeleteFileA
CreateDirectoryW
GetLastError
RaiseException
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
SetStdHandle
EnumSystemLocalesW
GetCurrentDirectoryW
CloseHandle
lstrcmpiW
GetUserDefaultLCID
IsValidLocale
GetFileSizeEx
FlushFileBuffers
GetConsoleCP
ReadConsoleW
GetConsoleMode
SetEnvironmentVariableW
GetFullPathNameW
GetModuleHandleExW
ResumeThread
ExitThread
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
RtlUnwind
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
InterlockedPopEntrySList
ReleaseSemaphore
VirtualProtect
LoadLibraryExW
DuplicateHandle
GetCurrentProcess
SwitchToThread
GetCurrentThread
GetExitCodeThread
TryEnterCriticalSection
FormatMessageW
GetStringTypeW
FindFirstFileExW
GetFileAttributesExW
SetFilePointerEx
QueryPerformanceCounter
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetCPInfo
EncodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetACP
GlobalUnlock
GlobalLock
lstrlenW
ExitProcess
MulDiv
LocalFree
GetVersionExW
GlobalAlloc
GetLocalTime
lstrcpynW
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
CreateThread
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibraryAndExitThread

user32

OffsetRect
GetWindowRect
SetWindowPos
SetWindowLongW
GetWindowLongW
SetCursor
InflateRect
UnionRect
LoadCursorW
GetMessageW
TranslateMessage
DispatchMessageW
SendMessageW
CreateWindowExW
IsWindow
DestroyWindow
IsIconic
IsZoomed
CharNextW
SetFocus
GetActiveWindow
GetFocus
GetKeyState
SetCapture
ReleaseCapture
SetTimer
GetDC
ReleaseDC
BeginPaint
EndPaint
GetUpdateRect
InvalidateRect
GetClientRect
GetCursorPos
GetParent
MapWindowPoints
GetSysColor
IntersectRect
IsRectEmpty
PtInRect
GetWindow
LoadImageW
MonitorFromRect
CallWindowProcW
RegisterClassW
RegisterClassExW
GetClassInfoExW
EnableWindow
GetSystemMetrics
SetPropW
GetPropW
SetWindowRgn
MessageBoxW
EqualRect
UpdateLayeredWindow
MoveWindow
IsWindowEnabled
GetWindowRgn
CharPrevW
DrawTextW
FillRect
SetRect
CreatePopupMenu
DestroyMenu
EnableMenuItem
AppendMenuW
TrackPopupMenu
CreateCaret
GetCaretBlinkTime
HideCaret
ShowCaret
SetCaretPos
GetCaretPos
ClientToScreen
UpdateWindow
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
wsprintfA
DrawTextA
CreateAcceleratorTableW
InvalidateRgn
GetGUIThreadInfo
SetForegroundWindow
GetKeyboardLayout
GetKeyNameTextW
MapVirtualKeyExW
KillTimer
IsWindowVisible
PostQuitMessage
ShowWindow
PostMessageW
wsprintfW
MonitorFromWindow
GetMonitorInfoW
CharUpperW
DefWindowProcW
ScreenToClient

gdi32

SetTextColor
SetStretchBltMode
TextOutW
StretchBlt
GetObjectA
SetBkColor
SetBitmapBits
GdiFlush
CreatePatternBrush
SetBkMode
GetTextExtentPointA
MoveToEx
CreateCompatibleBitmap
BitBlt
ExtSelectClipRgn
SelectClipRgn
LineTo
GetTextExtentPoint32W
GetClipBox
GetCharABCWidthsW
CreateSolidBrush
CreateRectRgnIndirect
CreatePenIndirect
CombineRgn
CreateDIBSection
PtInRegion
CreateRectRgn
CreateRoundRectRgn
SetWindowOrgEx
GetObjectW
GetTextMetricsW
PlayEnhMetaFile
GetEnhMetaFileHeader
CreateEnhMetaFileW
CloseEnhMetaFile
SelectObject
SaveDC
RestoreDC
Rectangle
SetLayout
GetLayout
SetViewportOrgEx
GetBitmapBits
RemoveFontMemResourceEx
AddFontMemResourceEx
GetStockObject
GetDeviceCaps
CreateCompatibleDC
CreateDIBitmap
CreateFontIndirectW
CreatePen
DeleteDC
DeleteObject

shell32

DragQueryFileW
SHGetPathFromIDListW
ShellExecuteW
SHBrowseForFolderW
SHGetFolderPathW
SHGetSpecialFolderPathW
CommandLineToArgvW
SHGetSpecialFolderLocation

ole32

CLSIDFromString
CLSIDFromProgID
CreateStreamOnHGlobal
ReleaseStgMedium
OleDuplicateData
DoDragDrop
OleLockRunning
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

VariantInit
VariantClear
SysAllocStringByteLen
SysStringByteLen
SysStringLen
SysFreeString
SysAllocStringLen
SysAllocString

shlwapi

PathFileExistsA
PathRemoveFileSpecW
PathRemoveBackslashW
PathIsRootW
PathFileExistsW

comctl32

_TrackMouseEvent
ord17
InitCommonControlsEx

gdiplus

GdipCreateFontFromDC
GdipRotateWorldTransform
GdipTranslateWorldTransform
GdipDrawImageRectI
GdiplusStartup
GdiplusShutdown
GdipAlloc
GdipGetPropertyItem
GdipCreatePath
GdipDeletePath
GdipAddPathLine
GdipAddPathArc
GdipCloneBrush
GdipDeleteBrush
GdipCreateSolidFill
GdipCreatePen1
GdipDeletePen
GdipSetPenMode
GdipLoadImageFromStream
GdipLoadImageFromStreamICM
GdipCloneImage
GdipDisposeImage
GdipCreateFromHDC
GdipDeleteGraphics
GdipSetSmoothingMode
GdipSetTextRenderingHint
GdipSetInterpolationMode
GdipDrawRectangleI
GdipDrawPath
GdipFillRectangleI
GdipFillPath
GdipFree
GdipCreateFontFromLogfontA
GdipDeleteFont
GdipDrawString
GdipMeasureString
GdipStringFormatGetGenericTypographic
GdipDeleteStringFormat
GdipCloneStringFormat
GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipGetImageWidth
GdipGetImageHeight
GdipImageGetFrameDimensionsCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameCount
GdipImageSelectActiveFrame
GdipGetPropertyItemSize

imm32

ImmReleaseContext
ImmGetContext
ImmSetCompositionWindow

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 291KB - Virtual size: 291KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9c504db2588dcf714f604af3dfec35cc

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

02:ca:d1:04:8d:76:40:f6:19:03:1a:46:9c:0b:08:feCertificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

d8:d6:85:b4:62:1f:0f:97:78:18:70:c1:1f:cb:ee:d3:9d:dd:97:0e:1d:4a:86:17:43:ca:1e:19:b2:32:8e:ceSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

ws2_32

crypt32

wldap32

normaliz

kernel32

user32

gdi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

imm32

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 291KB - Virtual size: 291KB

.data Size: 18KB - Virtual size: 27KB

.rsrc Size: 1.4MB - Virtual size: 1.4MB

.reloc Size: 67KB - Virtual size: 66KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

02:ca:d1:04:8d:76:40:f6:19:03:1a:46:9c:0b:08:fe
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

d8:d6:85:b4:62:1f:0f:97:78:18:70:c1:1f:cb:ee:d3:9d:dd:97:0e:1d:4a:86:17:43:ca:1e:19:b2:32:8e:ce
Signer

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 291KB - Virtual size: 291KB

.data
Size: 18KB - Virtual size: 27KB

.rsrc
Size: 1.4MB - Virtual size: 1.4MB

.reloc
Size: 67KB - Virtual size: 66KB