�7x������!�}³�h�a-zZ����(�7������f�~��$��������W���$�wZm[%V ����xA��4{6�g�w w(A"��q�f�>�D��˜�������}ԅ���!<-G�bp�<�kC1pX�2\WR��)E��e]�^Yh)��w]��D�!�dH�m5'L������������ʋ�n_)���-�}B���M�TV���T碍� k�+'�6yRN &�N@U�[o ���['6�SW�����L�� ~̛��c�f/���`�c�zOS_P7oZ��G?�/�XT�{ɧ��ʒ8M��(F�,S���O�L�I�vGmK4�� ,�z�=��P&���k߿�.:��0����E�������U�2��w��̚j��]�k^}.���� �7�(�����u42�=���D�x2��}qѤe�p����H+O���BX߈�A�kJ�������Z�5��;����`�������1�0$�#j%Uy���'��=)R�Tr^�F�%�i٤�[3�z�M�\��[�C��q{�H9;��,kp(��.�@��Vț}b�u�^J��3pEw<��?+����K����~(���K�Ioble�!UP/ᣯ�sB��8"������(�F`VV���]_�yjd�.���+L!�YH�ň��'�'�|lU��T��&M�{���|ҼN������{��b S��"�uf�qTg%�w#TK�| B]!=ӴI��a�:�ɺ��T7���x�Fo�_����y1y@����o�\ q�5M���'d $�gV�z-.�И�S}rv~��3��Z���;���H3�!~���&�[ߌLZ�H���� ���DB���ͧ^I#�]��9 ��� �w_[���KJY��C>��C���^��{�Ѣ {o�+{Wׯ��s��+U�8���V1�l�U���߹�ے}c8Yʝ��*������v����Κ K�6��GVخ���Ы2�O���(���q��V�0KV\�j��F/_��F��<�S�u\���G��B� �X���A�����Mc��q�h�u��:xH�`L�G?�ybABh���&�#6>�#��t��n��6Y�7_���3� /8e���ϓǣ���%v:��A��y����C��_�P�z��tkd��*����>��6Co/kV�mb�����G=��K/;�s���^藳��9X�p�=<fy�.0M�|��1�=�ܷ�/>K����e7n&p�B]7C����Ԧ}je�� �?�>e�P������^{�W�B��6ƾ�寮 �C(1��H�n���Ȅ!��ž/abΟ�Ip�a������X��DSFYq`��RC��c�髽�{x4�,uZ��v<�)���oy=�;�Eҕ���|+�v!:D0�+�j�VY�m���\�'Ʈ��UaL͌�-#r��/���T�7�)8j����w4 �m���&��a���N��K�#^M<[BH �R�'A���ǂ>��K������.n!.�7�������:��Y ��S(Ļ�R�H,RT��A�r� �y���>�ߪр�17�e�t�zm����`���o�W�����y��lO ��4t�j��:J�WRS������{����g���f�X�����1�~b3� �yK���p�WGe<�h<�ğjv̫��d���������og�V��_��8�ͷ��щ.�����q����B�#��'3�����������:�g�����߰���<��S��3��%�e��>���P:\;Wa�!�X��$�)��X &=��͚=�[�x{�tp������"w�\`3�(�\��/�T����k�Z���n��K"�ls ��zfHJ#�к��N]JWV<������4>�k��0��a�h����7�t y��J�hϢ������nW[���(�m>7I���M#�Cv��q�Y7tv7\r6�W\��ö�H�`v=��S�������������+S�M[�>0�#I��m��y�X���b��KH� �YZc��0S��vv�;���'c�D���J/��]�t<zh�0�x�K�j��ݤW�OV4q�\��5x�FT�����92-��/okȧ^5�W%m~2T���)>y�������8@� ]LpTb#�>�� �A�d�A�������.\�ř�j�Jg��XS��+{��o�C(J ו�@�8�� ���Y��oӭP�t"�>�ڐ� �XE�����uH�k>?w^���U�{�q״Y�.�3��x)�`x��Z{�߽� �$�ɊF!�� ���Xv� �O�-��t�<�Љ�+�� �xJ�֦n�ǃ. ɒ�l�_��'�?<S/��Z�� Y������������ R��{Ku��+���.n~�����x��l���>�Z�ki�"��C��(�w�����؏���o�� 4�������Kc)�^����*��Β�Z'�V[]Qs�d����#��Wd4FHpv��CJȵ��dɜV&Y$�v��������A�Eu�v>v��K����]z°��Q�<�vV���jx! ���N�A��c�%R�RӥT2e&�y�UP��-�O@{åx�/tIh���ϭ�J�f�>о-lY��T4v@P.�����-v:_IX٨��E�¤*|�~��p��|LҘ>�S�*� ��Y�2� �II�f���,�o%~~K���ON^�1�Б�)�p�_����t�\6�[���L��u�sb8�Q�7��J��ϥ���8Sb>G�g�~~�tp����� J2�-�x�92k}F��?�.�ͷ��,� }�C������3/lw�>{��NI�X�ʙ�`<���)��S&&ےU��%36vr,)f�跟��T�ĂV �m����R��Y�V��7��n�������S������,UVQ e��&;��1�=�o*\h��eo�� ������Fܧ?�J�>�ҧ)OFd�Z��])���<ѭ�uS���?�G2���U��P2/'Kz�M�P�$��Ov׆�eF*�g�O6v��q_��d�����h�u���O��i��g{(�ö1ۆ
Static task
static1
Behavioral task
behavioral1
Sample
DEHR+19Tr-LinGon/DEHR+19Tr-LinGon.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
DEHR+19Tr-LinGon/DEHR+19Tr-LinGon.exe
Resource
win10v2004-20231215-en
General
-
Target
4a1c7dfe05bf83f6de1f1e576ad1e641
-
Size
2.1MB
-
MD5
4a1c7dfe05bf83f6de1f1e576ad1e641
-
SHA1
ddb9c8783c50dd46f053c0283f08818432e0c9e3
-
SHA256
0cb044d25cbe26013ddcbb0d1b0a35f3ba63e913d2afd93878b1a0bc0a4efd2a
-
SHA512
0d25f0c468ea0e98cecd020f8e239adfa4c51c4351156748d7525c5d043b0fb665c51e80bb070448fcb5c4d27274b664e3095478a9d252adf4718f39eb9ba3e6
-
SSDEEP
49152:MtZ8JGaBnA9LhucM+zobCjccUQLerX+T6xMV8Y+L3AO:4Z8JHaUbCw70erXQkRY8QO
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/DEHR+19Tr-LinGon/DEHR+19Tr-LinGon.exe
Files
-
4a1c7dfe05bf83f6de1f1e576ad1e641.rar
-
DEHR+19Tr-LinGon/DEHR+19Tr-LinGon - I.N.F.O.txt
-
DEHR+19Tr-LinGon/DEHR+19Tr-LinGon.exe.exe windows:4 windows x86 arch:x86
71fa3909d6719bc04ff7326c93a9e169
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaAryVarVarg
kernel32
CreateFileA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutUnprepareHeader
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 952KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.1MB - Virtual size: 2.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
DEHR+19Tr-LinGon/VERY IMPORTANT!.txt