"u�@�S[�W�w'�"����⒟���ư����9�֯� 봉�7m���v�p�����}�)R����x`��mo<r ���e�3�i�m�7M�k�ң*ͫ�vt�t��ߔ� @!��}qlC�n��G5��9��26��q���R���y��� �"������Ճ���Cq����J��q<N*l�/�pb+�(��b��\�{\h���G)��v���a���X�o�: ��a"n�D��4�W3�"6��N�.����c�a_h��x��xAb���;����[ -�OJ��ޜ���C�iBݏO��)#�����Q�� W4*l�ܞ�,A�)�=�0)�_~{�dHnpO^�$yY���[���H�m�vX�]-��s�e�3��n��HP=�X)��a��m���P\<���el<�2{\s��ȍ�Swy�Z��%�l��V_���h�#;u����')n�s��§af�>� ������&t��'~)�Z��DbI�����:"�w�B��q���ԯJ�l0�Krar�-H�'JI� ���*@�7��'���>�h��%n�� Ti���L��eB��5��̣�:���mo�:�e֘�?Oa��'��]���SFīӋ/ ���xp�|�4T)���v-`��&������X��o;2w�*Y��m�9>;�V�@>`���/����k��g�>���B.���_�ZCޡ�����K_W>y�(Q.�ύd���G��Io���e8��Xuk�ߧ��ӯ��%��U"4|;���]�:-A��F�����Գt�ƫ3kF�A�'$ʭ/`A>9Q�W���� &�|9H�7��I&l� �Ԙ�`WU��zW��Ϳ��W�Hw I<Y�RZ� `&_�6VdI ܶ71,�,�q��r��l5�t�{�5�ŷ�[���^�;��F�=09��-.�5��aݡ�����J�pFt)^�=���݂=D+���m� ��3�?��b��!��������4n�v��<^y�� R?j]KL=�T�l��ʷ����l�/C˔��P ��O�JjאC���&Jp�X�N��b ����7Ś �y��~��/Q��x�g��[�Xp�x��Wa-*���Ѕ �F�F_àܤ����˙�_w�xe�ؓ�;��.����1'I�^���.�P/�eT�oK;�T�Zs�%I~�L�!�����No]M�pȦKx�p���PJn����aU~��V>�+������iׅ�o�y����_��s����O����m$��JYo�D^��W��0�c��CsNu� ��C�ĦGo�^K�x��=�� }}��ư�u�������������I�B��nHP���#�};����>Y����m9�V��C6��(M��z�:B�<�y�b)W�4�B]2�A����;]�eP�ě�ib6Y�E ��G���x)ƂV��M�Si��&!�BR�qg�d��c�\yl�:h���tj�0X�R�:�.d <,0��(R���VSw.���!0�RC~��Ԃ��4@Nν}D5�R}��R�/R N�q�%:�}A/�l=���k��A�ħ���x�̀r.�q�Y͇es':��s�n��;j�����.vu�iѨ��d���m_�v��%�1�bg��h��S�8�8-M@�M�E�Ϸ�k�V�b�y����P�W3Gon�8� ��Z�?�L�Q����%���r'ΕH���wN�(�+�Z��p���r#K݈��:<���kD�����H�P�q�g��#&'��%��"tS���+|���s"�#�0��8��:���OA�j�/E�q����Ҟ�d�|�9����S�`���U�/�rNl�O��2[¼��Wv�U�L��ύ����÷�C���X�-iw]�B�x~���I���.8��u7�/�2�A�Y1���A��[�ugv*g�ث����Z'���_ ��ҧ �!:�g�����C�'����i���Q��B� Z�K���Y��ue��Ieꊙs��ȬMK�_�g%hW��l���{_?;s�Y\Ki/��o��muv2_h.����D�8�c�@?��be*���ѧƸ���8{ ��%�P��g�6������j�#>x��Bd�ѐ"�:�b�?)b�ި��� (�ksZ��B�@�}�#ro�"��k�!-Qb�s���(7���I�vӗ]���o��~I��P�A�Uʹ2 �|W����7�0OJ�K��0A1.a�o��!{v��k!c/��������۷!���g�m����V�oϦ����mj7ć�zsLS��S�-�,� w@C�?�2B_*�%1�Ш�`��,"=T��i��Z�b��k]O92�_t)v� ����<��S�T]#�(���)q�s��:_z�u>>}��ۺ��>�r����ty��oN(���o�X�v(4��#����n��P6�ؚh�$�W��j a�U����oo#�e垐���J="��@�%��6I�Y4p/�u��+�Ψ��m��EEG�;>&c0MK�_o��`��a�������~^�⠵G1�(IT�d�Qک���g�W���q}������Ok.��.pO<��e�`��\v�d� <�&~`'X*Y��/�e�<��/�*w�6�P���(?M'Vkc��*��Y�3����-ۄ8��&)��Ј��7^�U��N�1���� �d�x������aA���i�N�����ڙ���?Z�����gd�����h�|��Y���%7�iP��] ��D^�:��B~U/H���z��#.D�"DRih˯�k�u�#s �������*O���T��E,�����!�;��ZL!�<�Q_�� &Y�N��636�x�(��s�R�Z�[2x�놺�b�0�h쳳��U7��Qx �1�[���3+V��� �/x,�`X� ��S �$(Q�x��7�پ�X|��/�Pbfbϸ�\���t/)^7L;qaX|���8t-���c�R$��T���m&�����D�NZW,����k�w��I�(�*E��wLc�����5� x�����kXU(����D� �78;u3ֳk���NǿwG��P�-*�
Static task
static1
Behavioral task
behavioral1
Sample
AimStar-CS2.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
AimStar-CS2.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
All Hacks, Cheats, Injectors.url
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
All Hacks, Cheats, Injectors.url
Resource
win10v2004-20231215-en
General
-
Target
26a75d900432c1940ebd78409ee92a151fc9c97384b8f433fdb25412e95ad769
-
Size
7.7MB
-
MD5
718e60fee2fc5e34349ada6496fd83a7
-
SHA1
64d31f70dbcd0a9e32aaaddbcd6f99ca60a23705
-
SHA256
26a75d900432c1940ebd78409ee92a151fc9c97384b8f433fdb25412e95ad769
-
SHA512
bd2d2e425f648081cabd0d2870978e101aae79e9da13fd4f26ec01d81fb163ab3940b258adc1194acde25be004a924325650943538ab4a8c45fb9d785a231030
-
SSDEEP
196608:NAGv1Oy7bfOH+a45QLne6FexVs9jYOsdTtsJdmnZlbofXKxSHuvY:Nft0AQne6Fex29jYOsdZ+QGXKYuw
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/AimStar-CS2.exe
Files
-
26a75d900432c1940ebd78409ee92a151fc9c97384b8f433fdb25412e95ad769.zip
-
AimStar-CS2.exe.exe windows:6 windows x64 arch:x64
7056f84404b7a682d11f4bccab10a32d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Process32FirstW
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetWindowDisplayAffinity
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shell32
SHGetFolderPathA
msvcp140
_Query_perf_frequency
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_47
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
winmm
PlaySoundW
ntdll
RtlLookupFunctionEntry
imm32
ImmSetCompositionWindow
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcmp
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strncmp
api-ms-win-crt-convert-l1-1-0
atof
api-ms-win-crt-math-l1-1-0
log
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 993KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 128KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 37KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.01 Size: 5.8MB - Virtual size: 5.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 151KB - Virtual size: 150KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
All Hacks, Cheats, Injectors.url
-
How to custom HitSound.mp4
-
bls.config
-
imgui.ini
-
yj.config