�41��kR,N�h��&����� �M;iN#��!��G�A��W� �ވ$�M�2���伆����&���֦߹����0*ݗ��E��; �X��p��a�&҇�f'F̍���حļ�:б/D�!y��<Q:_,� ��4Z�DI���.B䌲�щM�4�Q�Tl�J��(���;STλ��u9��.d`�;�V���7# (��e���fu)%�B������6�ꂂUg����K�cw�P@��hN�k��{��;+V������m�T($a`�bD�#��#�)"@V����Dc�~�>/mZCEtU:�^��[L�T�o�w�7� ��.���O��܋Aj:���Q�C���.��e:�ϐ�UX4���7CX7^���<��1�Ok�4�~��{A���&��t�?��1t���y����}l�+�k�r���)m1�Qk����W����>J��k�_0YUIv�[��}���u�Z`9^�?���K�no��Yd�����W��k��ʃ96%M�����p��W%��!�M�`<��8�ND���x����iJP◶SMp�wrr�V���ű{/�n�t��@_�?,q�<e~c���M�h��W��W��2�x|�ɵ����E�ZV�ݒ����t��i͞N&��}�P��ص'�� ��˨��+\Lk���ެ�]tæ�S�*�'SzB�ܺ����$η�en�ael���T����l�9���Y)��3(��fg�ƹ����j��N����Z�N�_��B-e�*��IO�a2�FK��M�-�����n<� �~�<�����KN���RFb/�}LJqgT��S���rlz�o��"���-�P$�ۏ��K;�3���M�וv�w����(:���E���KN�uRz����p�6tH$r���s�3�~�3F?��y�����H=����f:��ղ����3�Q�Mo�>�4�àܷ@s�{(��h���fC���s\w6!���$Ubú��Sd���)�������N[hu^��z�R�s������r��D(CM�M��Q눅.���kǾ�X_-`��[\�Wq��l]��+�;G������Kn9�xZ���Bt��A� Y���.}^�2�,;�nJ�.���-6�V��%oS���ͩ�-+��u�'�s\u�F3Ve��ۥ ��Lj�7�^��|+N._br �c�����$,W ��2Dn�[����g�8ûu~� ��]�J��� ��|Dm��A���0��juJ`B�Z�SϨ��-����az�I��Ed�90�V��R<O�\��LW��)�v��m5��2m��}wyN�$��D���������}ƈW��-�έ禨�042\�D.�@V���\��K���ʬ-�x�&��Q��V�8���D� _��/s�\E!�G8S�C�۔nGJNJok�������9<����ě��{}n���{� �����T��X�4$˨n�$ N$���4�i�LN����N�iT��_�5�� �2��r�;Ŧ�Gk�_|`Ӝ�{��9Ȑ4����a��O��:%V~��w�L���AD(�y�`ɼ���˘s%�� �pl��a�|��߳/��-��4�h�A���Rl� �2Yⳮ>��*��f�Y��!S���Ͼ`�ku�nSy[���\-0h� +��i�S ����5ptx��9�,-t��x���Y]�߬*������u��`R�[�\�t<Y��Y%��^�ɉ��C�5X�M��0��MD��s+��g)����45x4Zw�G���P<�{#J���~��J���$��sJ�k_�T<v��G�QI�'U�U|����.,��@�����>��W/n��j$�7��n F����[a�A H�@�&G��)�>(d�3�(Lw����v��5�i��F9��*~^�}��$|ƁN%h]]`��m���mN���+<$�9�'4�tuW�~>w�Z��۪���y �Nq�Z?�5�Na�b�Q���8_�-��4�Zϻ�4g��B�j*7��Rx�#����b����yy��9��8$գ��N'𰿀kСذ��;�s5]�(+�h��M��>�5� v%;C�y��v�L.�KЇb@JF�&0�YT�g;���L������% ʜ��h�an�oE��oL��~���� GN�,����:s˹�l�=�ůke�y������]]��hT�C�ޘ+��H���t������4C������ rn �Ҍ�u,3������ �,�,�K.V�*�~=4�c�¨�d<m�B������v�@�+�7a�Z�#��ur����|�zJc�-CŲ5r��6�%vK�����\)c[���=I���ľ�|��7�F���C<՝X����&.�hu���1������O/)?C9�,lHR�K�jz�"��A<���r����g�S��S���9����Dk�4��ł���c�?�������Mjrx����[�1e&�w�����)wx����������h��KF���ʻ�3=)��@Е�M�h�H�/���x��',��$*)��Q�����(Z�sybbB#ŤP~,�^������aŷ&}-�m�N�5j��͉x��D��ԃ8թH��ĥ�5+�r��!���sɺP����/�W�E%�6o�(�g�������9>������O��z������~��eJP�8ab��<>Q6镒k� q��K��]h�&�v��r�q�ƞڋ�Թ���AIl�BN���L��{@~�LR�!l/N75�G*�߲����@�� �L�/N:z����"{��vK���?�T*"���P�%E�����):��2 G�K����͏P���C "0r55���<1��'GQ�z3��������� X��WW)�<��_:/p�S����M�D�/�S��J���J�W����� ���;�&�Z^#ӡ6N�_�����$(,0m�6��V&��^� (�����aOhh$�WW�M[��#L|:��B��+��G��ޕ/������&�-< �;�GUU|Ԣ�Ss�Ԗn#o��
Static task
static1
Behavioral task
behavioral1
Sample
Cry2+22Tr-LinGon/Cry2-v1.9.0.0+22Tr-LinGon.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Cry2+22Tr-LinGon/Cry2-v1.9.0.0+22Tr-LinGon.exe
Resource
win10v2004-20241007-en
General
-
Target
3f2b21f09c550e9a05ead0fbd6c51b3b_JaffaCakes118
-
Size
2.9MB
-
MD5
3f2b21f09c550e9a05ead0fbd6c51b3b
-
SHA1
9c1f9c9dd5f8d524e3050f8aaee80a6349eca7a1
-
SHA256
ad1f86ea57650315c616ac249866290e7d583695eb06c73056314df537a4185b
-
SHA512
c1cd7e97e19945a51dcc468c0375bff861821c294fb81ca582e019d71fda4c4b2ca99b43498f91998cbb9639b93049650750ebef78d1c5dd0a18b4c94d2099e9
-
SSDEEP
49152:1Sdpo51QioQevQa90+ZgIgPS5kwNWRRS2G40IWe4xc52SfPvA2o7gFH4QBTKb4OW:1eu51Qi5eoanmI8gNWRE2uBlxceZMYQ5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Cry2+22Tr-LinGon/Cry2-v1.9.0.0+22Tr-LinGon.exe
Files
-
3f2b21f09c550e9a05ead0fbd6c51b3b_JaffaCakes118.rar
-
Cry2+22Tr-LinGon/Cry2-v1.9.0.0+22Tr-LinGon - INFO.txt
-
Cry2+22Tr-LinGon/Cry2-v1.9.0.0+22Tr-LinGon.exe.exe windows:4 windows x86 arch:x86
58c155f190f1e0078eb1365cdcb45635
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaUI1Str
kernel32
HeapDestroy
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutReset
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 1.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.ECrypt0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.ECrypt1 Size: 3.0MB - Virtual size: 3.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Cry2+22Tr-LinGon/VERY IMPORTANT!.txt