letsvpn-latest[.]exe

resource
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

letsvpn-latest.exe

IMPHASH f4639a0b3116c2cfc71144b88a929cfd
SHA256 796640f54bdad0f8a77fdde41ef8d15bde06cc5e1d6920159ebd8ab06a0e4bc9
MD5 b9241fd773a2808eed3f08b1cec5ff33
SHA1 044509e59d041d47dffb9608d46e677c20aec288
SHA512 b9743534e021c103a4a9de01af7323180452fc30a3bd16a87019bc41f1b0cf3b3c3bdf296a9fd71f5e2f995e244f07b23060228ff2399096092a6af118cafd48
SSDEEP 393216:mvaALKINVwr7B45AEHT0+lBSBv22a3ObLEDu3vJru0Hec67GJ4+3NiSAW:myAtSCeEzPSBw3ObgK3hrxt94mim
TLSH
T1310733146B91C678FBA22832ECFB52F73DE8E7AB2CA884054C9D25DCC93959D14D4E07
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Digest

25:96:9a:53:5a:6a:c0:92:bc:35:a7:bb:cf:32:54:cf:a6:7c:fe:3e:f4:93:23:30:31:4e:a1:82:e1:e9:49:0b

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=LetsGo Network Incorporated,O=LetsGo Network Incorporated,L=Markham,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c18646576656c406c657473676f2d6e6574776f726b2e636f6d

Chains

Jun 2, 2026

CN=LetsGo Network Incorporated,O=LetsGo Network Incorporated,L=Markham,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c18646576656c406c657473676f2d6e6574776f726b2e636f6d

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Mar 18, 2020 - Mar 18, 2045

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Serial Number

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 28, 2020 - Jul 28, 2030

Subject

CN=LetsGo Network Incorporated,O=LetsGo Network Incorporated,L=Markham,ST=Ontario,C=CA,1.2.840.113549.1.9.1=#0c18646576656c406c657473676f2d6e6574776f726b2e636f6d

Serial Number

39:fc:16:a8:68:af:c1:4f:52:6f:13:51

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 29, 2025 - Nov 10, 2028

Subject

CN=Globalsign R45 TSA for CodeSign 202510,O=GlobalSign nv-sa,C=BE

Serial Number

84:72:3f:c1:95:cc:16:f1:db:2b:a2:f6:60:df:2b:e4

Issuer

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 15, 2025 - Jan 10, 2037

Subject

CN=GlobalSign Offline R45 Timestamping CA 2025,O=GlobalSign nv-sa,C=BE

Serial Number

83:da:86:37:b7:9f:0c:84:0c:94:7b:84:0a:52:78:1f

Issuer

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jul 16, 2025 - Jul 16, 2041

Subject

CN=GlobalSign Timestamping Root R45,O=GlobalSign nv-sa,C=BE

Serial Number

78:4a:aa:81:73:66:9c:90:09:54:e4:21:c9:47:eb:c0

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 9, 2020 - Dec 10, 2034

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Serial Number

45:e6:bb:03:83:33:c3:85:65:48:e6:ff:45:51

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Dec 10, 2014 - Dec 10, 2034

Minor OS version

0

Major OS version

4

Entry point

13596

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
TLSH
T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-header.bmp

SHA256 6cfebb59f0ba1b9f1e8d7aa6387f223a468eb2ff74a9ed3c3f4bb688c2b6455e
MD5 5acf495828feae7f85e006b7774af497
SHA1 5d2eef3eebb9a72678dccd404475341116508306
SHA512 d1d40c88e2167315a309005b831acbeab0919d5a3b1ff5aaa273db945c8818fc2118efdb503e4bda055f309306e72224f54def0b1f0ab6f61fe4dba66784ed68
SSDEEP 192:bDIK82wKywC116+rwdTKMRjwgKhww4R1jwlIHvNbmwQo8TTJG4:bv82wKywC7DrwdTKMRjwgKhwwY1jwlQq
TLSH
T1551200F6700A043B5AC90D086E4AC433C8E8552F5AD558F7CA0E9EEBBAA5C3C24DD577
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/modern-wizard.bmp

SHA256 076221b4527ff13c3e1557abbbd48b0cb8e5f7d724c6b9171c6aadadb80561dd
MD5 7f8e1969b0874c8fb9ab44fc36575380
SHA1 3057c9ce90a23d29f7d0854472f9f44e87b0f09a
SHA512 7aa65cfadc2738c0186ef459d0f5f7f770ba0f6da4ccd55a2ceca23627b7f13ba258136bab88f4eee5d9bb70ed0e8eb8ba8e1874b0280d2b08b69fc9bdd81555
SSDEEP 192:mfR2FYRtCc9X1uikvgqm+LPTTw9Bu8Skn+x23acmHjZXuxZpCAe9Crxpn319UDSQ:mf0YRt/km+b3wG0nt2UC6rOf
TLSH
T12033C4D8D42DFAA23B58D85DC0B1DF63CCF91083E1059156A4F96A7DEB9A394334232E
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
TLSH
T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

driver/OemVista.inf

SHA256 d40529d07999fca28e58c0997e8fe715f1c9f4cb6bb83e80aa5e664ad5169d23
MD5 7324b0dc32938ff848158912d46fc0a0
SHA1 d838bd05223dd4084e2e71bc6e31d529a9521575
SHA512 e0883b633c166049241d20f36c7d6ba2876b7e36470209702652dc96db643a6a981aa5595e30545296b98351d8935f45eb9564c8cc9f347c36352a5f0c19f31b
SSDEEP 192:wr8tW9yCTi3x4vl/2bjR+iAUC7bMP+io3DcNSj6jvKFkPs7EQTXvt1Ld4Z:LWlGgkzo3DcNSj6jvKFkPs7EQTXvt1aZ
TLSH
T193F160641C83EE2A31FEE58407565EC7E25611823A172800355CFC549FBDD9FE73C92A
MD5 SHA1 SHA512 SSDEEP TLSH

driver/tap0901.cat

SHA256 2fdddcdfd530647bb4ebe83d2876c9e46a8f9bc877ade014ab704abe10199109
MD5 37bf8727805ca8d7bb4d0287de3296db
SHA1 ca0dc9920044fd0526f023f515a6c28a845bb57d
SHA512 ce69ccd7fe3779e6531a11f1ab7e1f0f7dcd94a379a4441e3849b63a18999e31e2d4cd833cc3924d81f7f6c74549538bdc047a2ab8f646eab4a3be7c5b0e1812
SSDEEP 192:2ZkDcDA1Gp5UEwQl/WGhYC/NoIVFWSqnajKsA3iU8Pp:NQpzlnh3VoiFWSlGsA3Qh
TLSH
T1A12208E249AD4483D9A7BD6003E4E9537C3D67CB2C5050AA21AFF2690EA73C6F71416D
MD5 SHA1 SHA512 SSDEEP TLSH

driver/tap0901.sys

SHA256 57e267ff2d6eb520b7ec7d5448e8cfef29ccfd2e4b72bd8bfa79123f9dd4a1c6
MD5 6cf8f27672d4158aa8f5bba12ab18dc2
SHA1 e87a4be3adf30e37dc1b65d4863638e8cec38439
SHA512 9fc82c547f751d65efef560d031d0649c0bd340f852b79f959282c2f8e89bd91decc84f5af85e3d3c10fe74bc2f1a2410e37e62f73e544e9e30681f4a8ebf2ec
SSDEEP 768:6S9hwKFaGB0MO3xLksCX9tIdgiWS+8p33YLHP:WkaG2MO3AtIVF+8te
TLSH
T12E037D828B8C2C47C6CAAA74FDC69F52713F72B1D62784867031825DD6BB7C1C3296E5
MD5 SHA1 SHA512 SSDEEP TLSH

driver/tapinstall.exe

SHA256 319b295a173eeeea48dfde5ec6c6f0b96c38f3857d9f38217a00ad314d9056f3
MD5 f723a8a616c7744f6540de195420fdcd
SHA1 ab9d134d5fc633d1ec71902f7d7f9523dbf9c248
SHA512 a2aa42ad13cc663498faa3fe463ba6493324dca311b9aa2596337204ee388c26262d4131b07b43a6c4e88d393c1341e505491d0006efff50ffe2746a5747dab1
SSDEEP 1536:MZREKJwT8VPGb8Imnsh212j+g9lvd11qObWUcjUUfJtR+:mRa8VPGoI3212jlTX1XW2
TLSH
T125C33C4663E8490AF6F3BE7468B146316A3BBC909D38C55D1249825D4FF3E80DDB1BA3
MD5 SHA1 SHA512 SSDEEP TLSH

letsvpn-latest.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

driver/OemVista.inf

driver/tap0901.cat

driver/tap0901.sys

driver/tapinstall.exe

Sharing

General

Malware Config

Signatures

File Explorer

letsvpn-latest.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

driver/OemVista.inf

driver/tap0901.cat

driver/tap0901.sys

driver/tapinstall.exe