ae�Glۖ�!&��gg#��ʼ�,��j5�,/¶$���� -������v��31-�(��{�*�]*Pp��h:D�ڏ��I�f�l��Cm%�W�`� �H�cܟ�Q��A�m�|�d�ȌX#��{�Jh�?+n�i-0�k+���F�m�̤3x����*��|<���]�Ih��R���TL�wݱ7�t<��z���u����8r�A�@`���Ah^�U/HG��ZƱ��p�n[w�K�~���de.Ð2U�:˻�d>�J���2$��e(�6 @�dNQ���O�.E���������6�<���c�S�R0ED��(L8�%��b ȑp��#�Ŭ-]� �2�N.�ܚGo�����`�˫G&~G4�W%�x������{Bc��0Rސ#ˤ�W�-����y/������:�� ް�[�����,g�"T� �hɇs����"���V�R�*/�^��t�=MNe� �u���^��ZTI���x fq�D\�?�� BM�Gk�Ν�;�0$�tØv#pd6�y�!�b�� ����o��G���t��i� 2�~�ZC�{�m��R�bv���@�d��^ly�!�V`�����J�����I��?�p�"w��0�CDv �r��5���8�am�QJ�L.�n���W�Q��s R�e��K�3*�!���yl�#I\�{�[�p��tFO�������9#?�'�[�.�Bw�B��Bv�4���[���T_�0����ᰉ|��LӺMC�r�՚x��#R-�wfg��ۣf�OW8eP��j�ܜ �Z= 4�wV�r�Ʒ�Ϝ���\��щ��}̿A�o��ZN������n��%,E�2����3'b<s �&��l��7����lֻ 5����i�=ԙ�����>Я���>g9� O���e�xaj}��@Ƀ����"?���Q���u�>6�y���Yr�p��a�� `6�;��4x$���%�tZ���v:������zV�"����rWl&�L���J���/m�����`\h���J����MuSl�|)��Q4�ҧ�J��+��*3�����nؖ�g��,�[c]���L�?Q�Aa4Pe@!�[��[J�Z��68�Tߴ_��T+]���n�!�jS�Zd':���)��G0V-�v4(��Z�a�zu������|��_�x�o/;D���50�����HV�$�4��^�g��H`�z�5ޟR���H��Svj� 9f���uQ &4�O��鮔�-$-W���~�G��]�V5:����b%*�e�������*`� &^��ٓ�2F� ��Ò˾�q��7sW'�!0�{��� g���q��&�z�qeR2[ �D���M����M��YN7v��c�������\�9�<B��v85a}�^oS����S�m�2���=45��9�&��*��U���Mp�Mh_w2��f����D[��_j#9����2�I��t��H5�����|K~s�#TQ�u�5�\�/S��:]���B�`�m����X�5�z��5�g��m���֓��Q3���p�9��� ���34�˧?�g��m�����݈�ބR��&{���q�����)�t�Y1���o���p�J�ղ���n���2�3�����i"s<^�O�I�$�ɏ����)��.`_}J��3�I{������T�2^1T�R |�Kj���äˌ��d~�����v�FO�!jd��|%����1A�ؘ����6�,�F���A[�Ո{�B��4+~|r�ěn,��εl �iD��լ�����@b��?��W�8�3 M�D�K&�A�9W�Ɠڈ/�TQ0���8uۋ�i����K�ZO�m���t7�.>bZ��*���DWL0� ���_㷵����qP���.�[�i&�unęʶ{7��Y��vQ�������^�S���n~g�%��_�mK��G��EoY�XN�yK#���s� 0�� Ѻ0�Ř�|_�թ}[�F�fn<n1���*��G��BJ����j�Z�d�O�G�7E�D��Ҵ$�6�ĕqN����o!kE�\C}X�ҧ�ɳ(���"-�ټl�' &�����nQ#��5 �#(j�<um����z��G�r��h��������g�v5���f5qs�Cc ��������W~��0�/^����.B��*�@�"�P�-�s��Rx 7<��g����S��>t����Ҵ1�1�dZ����o�����1�>���6}��(��E��,�0�_�� Q���n� ����v��ǟ�hk���@�������o��R��R;�K����#;�"%c9��t��_�(�9�%��òY������@��+p�I��"|�[��}�P��f=���w��ai/��r {���>#���Yf<�:�)��(�(X��\3����8S�HWX�M*����U��y%�����`p��RU�>�z��+\[yf���έ����H?��N�<D��#�ܣ��� �����v�5j֦�Qhb��n;��$O��T,��2D��U��{�.��9Ii�E�ο��shHT-p��.e�i�j&-/\�p�4���N�~ R����1"��d��8Ĕ�l�d�֧�?�R�V<s<��Dç>��H4�� Hu�Otez*�����JX&A�H�rj�Ɠ��R=������]�-wi���cv�����1Gi/����?t��P��>��}��R����͘hRi^8�I���o��@�,�6���e�Hc�zZ^�-Dz;�Xb�PP�ڠ`gݨ��,T�Q�>g��\qZa>�%��)�|}�c5��gwJx$4蔆����P,i�_A���ڛ�zi5�q/�jrl�b� #"$}ۀ��=s[�X�06�6�����+������+$��ԕ��s���oz���S83�(RτN�dT��E�[h�tP����N�ŭ���|�m�FŮPm�8[(��I<s��43#]�Ρ�z�8+�$�f��7\n)�E���œ�nO�6�A���;� T�X4�o毺�,��S>�j�Ϗ�R+�ml������mV^z�'���m!bt�Sۜ>��I.���c4��Esg�Zkv~����)����
Behavioral task
behavioral1
Sample
GalaxySpoofer.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
GalaxySpoofer.exe
Resource
win10v2004-20220812-en
General
-
Target
GalaxySpoofer.exe
-
Size
5.2MB
-
MD5
45883703a2e940c85fe8d6502af5881d
-
SHA1
2c307fb4a3a98a6758a87f945e11f850aeda2720
-
SHA256
de973b7611b036982ad119de0ad269689dfdac1ff3365e398a3d61e29bc971cf
-
SHA512
cf1ca4d2a7f5384dd5790a712051e23cca97266970a8c2e9808a0f95a9fdc62c611654433b262880ef8ee6f47380858ea2f9f71214396f0ed6a89adcfd37040e
-
SSDEEP
98304:4Txl/1Xf4Cl1KoPlaJZJXXKF4TTjsloI8c+rSEfQj:4TxlNXf48bPlaJZp640f8cMfQj
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
GalaxySpoofer.exe.exe windows x64
8616dd98a6c7e117e7fe324d5df84900
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
VerifyVersionInfoA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
MessageBoxA
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptEncrypt
shell32
ShellExecuteA
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
normaliz
IdnToAscii
wldap32
ord35
crypt32
CertFreeCertificateChain
ws2_32
getsockopt
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
__sys_nerr
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-stdio-l1-1-0
feof
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_fstat64
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 424KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.1MB - Virtual size: 5.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 116KB - Virtual size: 116KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ