ߨ`��Oaa ~B�g{����qt�4���س���e£ª�*���*"f�|�C#��4��QiiF��?ca�q�r˨r��1+�rۿ���͗k+j�ѱS��I������35Аcҥ�q+�b`-���Q;���S2g�Z;X���``�G�W�FM�[ ����Q' ��/1��Z0������+����J��k���I�eu����AB2l��F<��Ϧ9G~�!f,�ʴ��Lj �p8�h �gU�e��iXiOMc���:��3��M�"�S�8J��H��m"�p"��__?6�i�x��� x8Ն>��ϔ��&r�s�o��#���f.��6��1��r~M"�b�;&OT����� �kޥ���I�� daS��-�+T[����)'��)y�m. ���v�Wg�(�رO�/���ħE�����m@Q3�1�SY � bǒ� ����81�ǘ�A z��wV�ad,����[�k6}��=��-���S����Ќ�[Q��?R:J�f��[r�9��˞�0)Y:Rr6XɎ�F��R[߂5�Af= �@�tˡq���@���+Z6����:X���ٯ8:,V߷ب_-�tb-�Bp�_6�%I?]��@� �?�Qt95����Iə��B$�u"P�����uV���Dy����l��B�oC"u=\|Z�};5�i�+�E�T.w9��-�z��N�P���/At1� ���7����p�4��� ~+Dbo�7��۫�+>����c�8Y.-���'#�OmY{��yX���!O�bZ���L|G䌩W��N}���i3�� R���ͭ~�Dz���[��$��*ę&��wn� �eX��qf��L��2h& �����cDb�Rԟ��� T��d���j�Z)J�I�Y�WO���hF�}�O�u�Ú�I"�v�h��_�ޫ���b��Y�A��1�ͨ�D*��𤏡� �PF�)3?��d̤�"jLn!������ٿ�Y�c�f/\E|,�M��#�I���Y��7���b-�k��5i��5�lϻY*�����ؑb���oZ�lV�F �*QA���t iLL�=.̃�?IO{�3eGf���h�fiVDێ�V�\Uç;��G���jm����k��N Btv��P��@%-����s�>!�E�ةk>�§ۃ芔HXq_� B�`������^�R�^{� �[�:qM�6�K�M[�s��%Ҷ�=3$��Ϲβ��[&e��䯳h�-�)�Wx�5���>)Y����m�����W�#����c�jsZ>��[^{q�e�G~���[V�# ]��`rs���B_W�C�̱��pfN��<ꭼ#: �R�����D������y�r� �O����!۩C�y�3O�(��`ԗm^�e��v�t�Fa&��Um���@5��rqF��/7��A�o�����gy�?J_c�H��Ꭰv�>���4�p�}kz�L*3����:��r:�)��5c��?���j�����2�[y��(P��E� 3B圝�R0�cG!r�oq{ʭ��(�f͌�$�n���C�:�9�ā�9����B��Gnq��Ӧ�Om!��|k��p#��4Qpk:4GJ4�H��,�|řGB��Aw����� ����T7$b��&�Ǟ�?��@5ɼ��;��-Y� �Q�r���cO�U� h����P��XcZC*[�P�Gr�0�>��Sʰ:�s�b�>�˦���+�<��� �N���y�C�5%8�-u@��p/���*S���3���ۂ"���= T6�~.1X.s���U y`������d�{Dă^8��e�����*�/���S���`0�ەC|�֭�掐����9D-t3�t}s�%�;@�Ka���U�R�(��Yi}����tH���1�>e�?Ov��<Em ���/#��c~M4�3��jVs�����Jo�ٞC3B@]w���������GYΤ��M ��n�\�_���F�����ƣ�y¼V�⦅*-:Ce�D�?��{�ݽ�����9r��g�{^���RUDr�z������߫H� j������#қ:�ɺ�3M9�(�z�� ω;Ԗ����p`���[k�K!GԲ�f"�b�OAd�8��MX[����uo�,� �9������z�zu�G�E��a � �!&/{�w�������� ���8��V������ހ�j5r���f:��>��`_�=�K7d�{J&|�K��6�~�~��$~���&�����̅Ƭ�-�����i���� ���G[�磸�NU��h5����r�Z+��.����4I�3�>u�`�@����L�-@@VY��m�z�9T����o���gmE���QkRu��Q�X�a���1?Hi���؇�0���Ĥp�@# �ωz�D\e"C��2'I&r���[��]Rk������d�����.1�}x��?b�9��m�N*H"�ȾW�;y�roU���w��5~V�͂����c��Y����X���x����d��l�M�����!�д�����(*��7��0�ʾ�$�Cf%�u须�W<G���X�. Ԗ�V��I���:�85!��@��R�R��O2����x1�ЩzQ���l���"~�)&`D@��~�,Oӡ&O����Y�&�,O�=|ћ���v���c.]���F]��Ok$��X,�(ex�4�ְ7�����Wl��#��My�R/�� ���tHgA��W��*�R���z�v��6�ϫ4�0%椅�p4���qE%J_�X,d�ib���n��B(LŮ.`,� 3]L} ᔏ?хcY�wNƣ��=Q��2�RTb���j�3^��h�#�K<c��[k������ĕev��n����70�`���a~�@ΡE�����I�|�%����d��c��6�!��) ���\]���cCAJq�|�q�����<Q8�(�:��:0��t�E[R6���gF�k#�*�a�����zZ�5�)Ql[8�0=4z�����@�ΧL���r1*�>��J��M9�>`����[��3t#�0�Z+�I� L̲�Q�Y3�y�{=
Behavioral task
behavioral1
Sample
ShaiyaNuke.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ShaiyaNuke.exe
Resource
win10v2004-20220812-en
General
-
Target
ShaiyaNuke.exe
-
Size
445KB
-
MD5
24959555377bfdd569dde190b0ca19e8
-
SHA1
ae4ee75a1bfa4ffe2fe70dfcbe6e0187a96c71ed
-
SHA256
07c4c5cdb8db5411c65045cf678040d313842ba66480b6fc4cfb6213e48fb28a
-
SHA512
c4f6cad1fe63b47281c7a5db911dd10429413cb7f414a0be4b06eeeefd2e8e94f2d35473b58591a3792cf9b62909247904b31435d4224e57b83cab35ca97ec6b
-
SSDEEP
6144:P4eGt7n6yDAe3YAEZZ3Q19wQK8O4DiQNWB5P2G7GTeenwSnPYCLIEid+DIriuZi:QJt2yr3uQgPgUPtyndwLd+k2uZiF+
Malware Config
Signatures
-
resource yara_rule sample vmprotect
Files
-
ShaiyaNuke.exe.exe windows x86
e9dd8a82786f70f173ca3f26d08e8a71
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetEnvironmentStringsW
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
msvcp140
?_Xlength_error@std@@YAXPBD@Z
vcruntime140
_CxxThrowException
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-string-l1-1-0
strcat_s
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
user32
wsprintfW
Exports
Exports
Sections
.text Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 427KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 442KB - Virtual size: 442KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ