�p8��"9�J�?:�ߩ�l��ni��.W��ə��w+��A��j.�Mo��6Բ^k~ �H�@���@����$��y�ݮɷ]Rqeo�.�5�r h��ű��q^%2n2bӢ���VI�H��W���S=ʮ�k����d����Ȟ���������HS2W$�� ���#Cd`.*�$��e>����g��>�"��1��� h�&%�݂IX�_n �蹷�+(�2�=ܓNX��*�]"�kݵ@'�A�>��I���=5� ��}ЊAb�T�����ˌ]���l�����u�[��:#���J�$D�[a�j��ޗ��n^���`v��窬�0����wt:�PF )gɢ�E�imA�3���`Ⱦ���"{ g��ŀ�Jӛ��9 �y�5�㗬|�◥)w���Ĥ["��?�����v���h�p՛9�&I�ܮ>,��7'-���M�s�.rDwM�;��Xݦ�-I_�$�.���#�`O�!�_��Do�#zˇv����U�Q��Y�f��=0��R��Zz�8!Yxm�i��%�S�3d�����>h-D���������a�%q���v��ծy����YG�&�b&~g����^�*_ iK��]v�l��-��&��W�/>����L�$o�'7k;�:�U� �6��F}c�"Ck�9v9�`a� �Y��+�?��Q�8 �muh1���o�o���$/w����������a�u�>+��;s ��6V���(~7A���A���S�[�-��B��+WP%,,z��"z����՜R=�A�f��`�W\z������k ��ַ 2|�]+��340X��b+�k~{�E�;`��)1��;�״�*B^� 0V)�`��e>F�?���zyYP�UN��Z�����$�,`�7�����K�vBa�`���W���r5��o���Ve<F2!~ &���S�gb_����m 2��T�s>�>[��E:�'��^]��"ܛUep j��C�W�==D���y���' Z�@]j��ř��U�ޣ�R��!�Z7L����yХ���s�3��B/�>�!�Մ����h�6�5��N��[���:r��@�h=��2�сB݂D1����ji�5�xs��Nb��ir�w܅ �%)��F7m�a����/��p^�7�GIp��t���/)DR����u�a!@r#D7M����(3MOB�K�X,�$���SVX���.(�E�Z�bx5��i���ܽn������Q���'������QY͎�Sw���V峷*`"ʽ�����w@��U� ��*b�d����j/ ưbǕ��實"���n{+( L��6��*A;�Q��_c��w{�i�������Ү����aۭ�xN�rf�9�k)�'��a�~%��_��'F��iRK�b�ZldM�J��Bg�͜��G� �4�T�`�20/̗O�2֦|@J ��{�/�0?�Z� f�v�lC����$!ߥ�V�W���$��-�P$�_5���5�^kf4���*���<�C�p]S&_�����}��xf2�q��"���~�S*cb]���] ]�۴�Ȕ�8)��t��P)_E�/hkWn~Kehx�����si�B''�������!�x+�|�9��`��r��RD�gP��n`wP��k��U>�S I�a� 25��(/=ʑ���kؠ�W�\5��P&�:��j����BY�mU�U����V�qN�݉�/- �m�{��S���ƩK0��u�J����i��6G�q�%\XK�h:j_yo���OoC,�H (V)+�?��%����u��1H����J聐�>�|���3w����_�5�Ԥ1Q��SH�ǘv�zA���LS����ƒ��nY� �G����:�o�@�����(F�X���U����٠NR�ӓ4o�����8!8��~QKW�}+��LD��*�/+��I�[B �u������F���Y0͚�7��̪���z��4��_$�d/q>��f����+/l�g�Q���d3�1NɔH�<M�Vv�b)v��@��d��x'yc1�VO�/��>r0e��1Q �z�}���e�{�����'�L�Ø�}�=���Q�+�z�ST�����V~*fA�D����� ���zƊ���bɱ;E�pR�M�,��]�V[�ɋЏ~A��s��O�R��#Bp��������+������OE,��"8�,�k�J�g1��sx�_�TZ�Ŕ�M���ܭ��a(��<�Á���zQ��T>���t1�"$�y�f�j��mg>��̇�MGY_^�ʉq��z�����<����j �r���9�!���P.U^�$E����>���L@Jڗ����XSƺ.�e�m�Y�C^ݪQB�}�G7�x� &�u�]]=�� �O+��.N%!f��1/��ڨ�� d�,�^����O����״�Y�q��a*[e�"z���b/�GP���pu��ɭω'�1����e'P$�eɈ�;��� 1�\Ǥ-F�<�eFH_� '��fo�d�������L��d�q\ߡy������^�,㼂`!�#�B�Y�S�j4)�jZ�r׳>;f����aJ �'����z%�!3`��N��{T=��=�X9���w�f��@e!��Nb���*�D �ޘ��e7w�DHܜ^�q�$��S����p��@zz;rx�!Rn�l�3#�צ�#f�l��6�8@p��4�� \������Z~���}���0�j{I����0D�$��PJH�bf-�3�`�NE�� Ĥ|� Is}�#�[ѫ D��¸$�>"�t{���&�^�m�]�"6'�)P�����/�9�7pG�F1��H���2<Q����=��%*s6,S���BV���� n�YYR�y��;BpQv����b%[#(��Ԉ��b�K!��!{[C���Եdk����Uh`��GB�(O+�A�K��2W�V}��������!�^՞���iP��@�S��+���1�/Y����L>k(��PULYA���&�N��>��Q_��A/L^����0��I����^_�z'�%fvҲ�-��D3G8�R��t@�z��^��:�
Static task
static1
Behavioral task
behavioral1
Sample
DEHR+19Tr-LNG/DEHR+19Tr-LNG.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
DEHR+19Tr-LNG/DEHR+19Tr-LNG.exe
Resource
win10v2004-20231215-en
General
-
Target
734e1261235099cf80b1dead63db93fa
-
Size
2.0MB
-
MD5
734e1261235099cf80b1dead63db93fa
-
SHA1
f2c78affd1080079125725bd2b5bf11bdc55a40d
-
SHA256
ddc768a929a80d6ea45b23a5ea1e760313638ed2f8f1839e52bdf18e42f84adc
-
SHA512
1606372b9fa57013d90cbee8a6878c416ef6b3ef8823ebb522074066e684f3f52503ddbbfd1bbcc7e1c9c53c12ca6abe1acbe9de5a20b2ec345e8ccac5061a0f
-
SSDEEP
49152:2sQbiZv2zvlcYsGIi0olP6UYjMwnfa/wrY7v:iT9fITorYjMyiv
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/DEHR+19Tr-LNG/DEHR+19Tr-LNG.exe
Files
-
734e1261235099cf80b1dead63db93fa.rar
-
DEHR+19Tr-LNG/DEHR+19Tr-LNG - I.N.F.O.txt
-
DEHR+19Tr-LNG/DEHR+19Tr-LNG.exe.exe windows:4 windows x86 arch:x86
7a82ffc832a28aee2c8bb0833529875e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord307
kernel32
HeapCreate
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutReset
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 952KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
DEHR+19Tr-LNG/VERY IMPORTANT!.txt