69��"d� �|���(�Sj0��k1ݍ2�a�1����{�{��D �S!�n��*S��k��w�m�]�B ���]�W�K ب�6���X�X�����M�8bE��D�JpJ"�ztn܉��Q�B�t�3�`w���H�?��1f�g�E�41�)}<�;����T�bxĝI=��d^�?��-������ģo�$^[��!%JQ��� ��\��.�e���}+vXY��sD�.SB����,�o�r�5�{!�K{�(9:?z���8�[%�����c`�t� ҙ����X^�ٵ� ��--�*��2��م�J�_��R��TB�|MNS�_����;�;�\H�Vd�.V��H�����u�5P�����Y�n��V'������ �JY���z�=-���O��d�i��fп6,/�J�R�ґp[\�|����6�D��SQN�<w�M^b�>�8Q�p���~��=vnfȻ�\TOJ9o/��\�\gK��&�"A���d��h�:��oAc+�^��U�.<�p��f�@P����W�U��04�eCD�Hq�F١]��P�����i��Pz&���h�_��9ڗ�`���+�Y*E���F80Y�������������l D���@-|@A-�������ٸ�B(�M�wB���`r���wU#�TuN���G���)Ld�d��w@�yN+�Ƃ��d�9L���!����ǩ2G�ե7�ҳ�͉*��s��G��i�(t��|<����y���;W8�X<�����=w�^jb�o��;�T7y[�r��\�gh1��/�������D�� 3�/�6) �9��{����I��=��9f���e8�����SBk�I$G�U��.��)���z�eQ���.eZt �u����w�a���j�� Yq%���ՒR��>P��+ ڞ�(�5�8���%���q?g�2��A�$����Rܶ����#�F���D �܅�v���,��*�� �E���\��,����7�L�����DIQ0q�E�<���6��ca�@�#7��6U݃�TӀ�ƨ'��mh����0%h�"�M���b8\�@e����I-� �y|���8����������S��KW�UA׀g0�ɵJS�/�:�YCO�Q]������EСe�C7�9�(�����pCDhusI�����v����}'My?</c-�E�:��o�p�͆V��2�ht���B�l��3@È�,M�H�����r),���0��0�l#��{8�:A��N��b�-��[f'��v�m�����l�uNf��vл��,���1:�a�7�k����V��ѐ�S�ǂ�8�o�]�=��H8�6��l���՛�F��%|j,�A��K�y���8��Il�� F*� Z��:����-L</dum��A���/Lm�]m�uF+�HOƺ��v ����1ט!���#6�=OQ-��O�z�ߑ�����s� �+����k0�'O�v;�2Y�`�� H����o;�����|��k<���B)H����D�+��f�bB'���1�*2��n3��>{�فQ"�j�V/��:��q������k�� E�2�\",��BrC�Ǽp1#�;F��`B�9О�H�Zm��~ײ\�ϩ����~*YC�T�b��a��5 Z5����Y�IO����������H�Ϙ�1Z�����rL,-ZU\��a�݂f����mh\�;��_Vu�W$��qv�9�{�.��IN��/�����Og���a���}:�;o����Z�P��B�r��Mă-!�1ZP�_����-&"�߿-��� �x�"͓:���L�v���â%��ܡU�$�.�ozԲ����:xYq<˾��&�5��JT5p��j);��;��R&-��ҡ��0�b� ��l�f��롼� UDLiB��E���U4��'�IQ�\2�������!����� .,a"J���f�67lZ�j&X�Y �������?�^rD߅�:���'عh��G1�őt*L"�G!�Vz�l��sĺv@����쿔��2 �0:mG3-��fk��≶��S�,�Q^������T�YS&����`lJ�W��&��gm���PQ;�*�-�J �>],�_�͓>���p�yXfz��5S '�kbͣND�<AQ��JzLb�`�$�bZ��(T����4�X����,����/e�0� /U��<rFK�U�hm�{m�TtG��x��6^����:���1'�]|MC�U'���n���!0�ʆ��=�*�qn�к㱀d ZzEO/���Ԙ1)�kް�9���Hsk��u�R����2��:�S=���2�j��{��/��J��\�rH�`e�A����f�4,�5a��Zt�N"����s�Q�q �8�u� j��Vtt#��D�P�&�W�ȥ<��b�نz��]�q����#�s($�Z���b�J�% �u�E$�݂v�$T���܁�V�m橴�#p��p�b�5O����'�����T���B�dHڊ�F�0�Ρi��egOPn�^� �ߥfbSBS��]�f���n�e��x�Z�,U����`2R@����ڷ(����],gY���k0;��_5���6�����9ɣ��l$�[�&��R��zs�� ɰ7u����K�a� �=�Η�E{v����u:X���ʙ~AɄ��#Wh4��4"m蛫4���YQ��ȃ�ۍ�y�ى����7�(VQ܁���1ʱu���JM�%�L�T�QcZ:�9���ثn%0t~^T�6����o5~����{�z �H�1{iKc���Q���K�K�@Kn�Yxn߆ň� �R�a���1�H��[��S}`ӧ��a��b��{��Tȏ������íw&O�8��E��Im�q�.Ԕ`2v�+|�'N_�o��Jx��N���1��ιK�( �8U��uD���T)��n���T�E�gi���z���$?~+}?[DY<�ze��O��۲j�������� W� �l[$Hggz��695R�}Gv����l�����gl6��3���i�oV�n'����
Static task
static1
Behavioral task
behavioral1
Sample
Readme-说明.html
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
Readme-说明.html
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
TeknoGods_SamHD.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
TeknoGods_SamHD.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
TeknoSam.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
TeknoSam.dll
Resource
win10v2004-20231215-en
General
-
Target
0b8d15ca2578e17e11ec4e2da7bdebed
-
Size
629KB
-
MD5
0b8d15ca2578e17e11ec4e2da7bdebed
-
SHA1
ba119679f89f72606c8960b1107c46eb249972e4
-
SHA256
5012427ac6921bcef98a640b549fb4ccbcd5b55d29167a477639ad3a2481dc41
-
SHA512
0c7265ae27bea0b2e4f9ff6fea0fd0274bccdd92c6cdd0822c41b017c73beb512351501ed77dd8246436cb682af054735f2427e32d939125381151b032dde937
-
SSDEEP
12288:whw0XEPST8E/A8qeSFtAae3MY12Cs2fQo7SZUPY7/:wFQyf+e3MmRJp+CPYj
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/TeknoGods_SamHD.exe unpack001/TeknoSam.dll
Files
-
0b8d15ca2578e17e11ec4e2da7bdebed.rar
-
Readme-说明.html
-
TeknoGods_SamHD.exe.exe windows:5 windows x86 arch:x86
84596f4be172dc7ba583afe5264a66e4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
Sections
.text Size: - Virtual size: 32KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 696B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tekno0 Size: - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tekno1 Size: - Virtual size: 257KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tekno2 Size: 320KB - Virtual size: 320KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 332B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
TeknoSam.dll.dll windows:5 windows x86 arch:x86
d1e49b6b9ac3520ff67cd88af1b82520
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
DecodePointer
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
Exports
Exports
A�y!��R��&B�5y\��C?>x��z��Y`~s��O^�=�9 dt3�7�}����������,�Z�6k|�ܮ����x:e�L��b�%��d��t����Yv�ޭ]�~Gc!NT@��C�pL�U)��R�����!�8�+���:j���P:p�v�ea�����;���~if2������\�E���d�D9f(����G��~~ȑ�(@0Q�g��܃���X��=���,*�{c9P~�R�Dw P���>�8�����#~ǒ��B��8X���ﮍ�K�K7,��s�u �O2tG!������ƓqL���_�� ��L<�ic�p�Hؑb�w�#މW������-?.Rӱ���W���&�����f,G���e��`� +d�y�.0�}�B��|�^��=�����ɖ�����~��A��<N)_�C$�<f�~US���X��h<X�L�-2�(VDŽ�oރW�e����"�l�h��XY��(�w����M�O��Qw�c!��\^9-���U�:���p�#k���j�2�V�.G����e��e�� �#F���sU]�e��Ppb��Ju�f�,�ȶ�G�mH�i��`��,O�'�P�]y���W�9��?x�v�����'�'_{s�\W� ��Y w���A娼�x��6~���.������ X<�J�9�o҅C��,�g9���5�T2�� KT��Eٱ��� trJ(x-�c&���ܜ��n��&"f��BN�#�)�5��d�^������3�O�ҍkF������;�?��S>��⿂����M�7�q���K��; ��j�)w�� א���O� �vT���1���Z#�z��+��p|T��q}��lR#�7w:�� ����Q�Xq�!ij8"�M���اr;6���p������n1��4;8��e������#g:D&_��V�F���Hp:�),{�x���9ye���LJ])���k�ت5���s���!`i`��=-��*fk���K6!�*p�����X R����\�s<XP���ˠ#!��W�C|/�I (D���RN��hG�4'����QX����>OQ��L@�m� ��� �?\���-6��5�ڥ-��z�WPM�Wz�;�a��sV'�����+|�B<���J�G�߳6R�t���D4���gU1q`Qmgv�U� c���@E2�*tv�b��h@ |�9��!LP�A�NAz,��,��Gn Rx^f���aS�0�J_�Z�JE�Qn!��k�o\m�����A��_X��-�D#<��H)D��J\OT��t��o�����%..fw�v�#��0i/dM��/�� �f/8�Vr�#�������E�Bg,z����䖄]y���1AZ�nq��Q�#����D}�k��T�>���ݏNV9�Gc5��j<3�U_�N=*my�Ӈ��7�� JxR6L]��Y��J$�����7j+�׳�N��!J�����J#����PVEqV���O[+۵(��_��������'Yhm��tb��m�宵ȇ�5,�X��s�=�= ���y�z�R?�y��R 0�W�q��e��߫qi8a��}[��E.�﨎k�ߔZ<��tFR���� B:,�A��+/���~�8�b���#S#r��k@T֒�c`���*?�Gy����EL��J$pu��4��C��e��)�`R��*�_�$��� X�{�Y�Ek���3�g%���ӂ��=ڬ~s6:���e!.�� ��F��f��� ��b���ǒ;AhoW]��/���_����nH���Yʎ�����DāY�K��`do��2�F����ċ��WY�h�� ���v���]�����'OS�nMAy�g�E�� ���2a���������&S��L'%�R��j��.� ;��{�v�Ias9s���{�iP�?]�(θ���|���a����#�8�[�:M���V��A1-����� �QC]ئ��d��y%A�2msރ���������97�M����ⷄ��� �r���=e^��P�E� Sⲹ J�N} q��nօ�0��� ��^p�|vgtRG/��O8���Rg��=��x�p-�Hs>Q㝟�f*l�+�S��Za9��9~�%>�&sJ�߲�K�7 S��8�=�E���=ԅ�A1,ʱ?�f�+1���I����� ��4��e;�{�NY�L����yN�b1��k�eJވ�n *����mW����t�<%�9�e*B��<l"C���GMrY0{Qj�����������?R�MzFayk����n�X��D�Z�ϐ�����N��H�o�uA�ߊ�,��N� g��aXi����\hS����):�ЈK��l;(j*��<�Q_(i��@ ���� ���<_O~��SáA._�Gy�d�sI@i�R�Ib�@�.5 ���6eX·Ry��=ʜq"q: ��F�zf(��Z²[�@�a�/��&H�N�?����y@���_u�;�$�/�P�����0A�u���B(�yG�`_#�'krtȡ�f��'�]G�}{N�v�h@���� ��6 XÆ$ �8~�~l=�t 7a�[�����M���!#8�����j�P@:r>��J�H�{��� ��t3��۲X�5��hUk�O�zg�mVׅcK�h�����s��@������=nS�� 3��S��4R�n����O��:���v6Z��:"w��~ **+�'�,��w)�oޫ�R����;�lHO)HA�uY8QD���#�V��J;��G?·����?� _vČ#����W��G�Z���V�[�t�c6�BX�����*�-,@u���P�!�BU��HV� 3����/�8[�ϯ�����¯Z*P��A)�R_堩#m��А�` ��,�^�L�?eȱ���i*a���7�2��_���S&@�k�n���Kن'�cQ�ؘ�p9�R:�7,��]�S���bVO�,����Sf@7]�o D.�l��Ri�/+��H�$<�I�цR]�t�c��/ 9��ns�Ү}+��r�岡[ ��%��m����[M��r�����+�DA<v
HookConsoleInit
HookErrorFix
_x
Sections
.text Size: - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 696B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tekno0 Size: - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tekno1 Size: - Virtual size: 276KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tekno2 Size: 316KB - Virtual size: 315KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 512B - Virtual size: 348B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
readme.txt
-
游戏说明.txt
-
补丁说明.txt