General

  • Target

    c674a32c9609998c86388c390c14f24f

  • Size

    2.1MB

  • MD5

    c674a32c9609998c86388c390c14f24f

  • SHA1

    8e0e35026d046a196402dd7f3948915bd682bfb8

  • SHA256

    04a906fdfb7453ef38929df4b147aff45c93e585a95281def2383b6a72bb5039

  • SHA512

    12d5825af175058431bc17d3cd92e71eaa25c2e2b5670ba248b40825b056d1fbd437854994e97094f0feb2ea4ca1390a7f9ff823f8b4d5d19ed9e81fc2186cfc

  • SSDEEP

    49152:z+VF3SmoXhb87558aAGon/o/TihwpmmNq8nRv9ok4:S7SNM58nQpm6fnMk4

Score
7/10

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Unsigned PE 4 IoCs

    Checks for missing Authenticode signature.

Files

  • c674a32c9609998c86388c390c14f24f
    .rar
  • cg_sy.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • cg_x_update.exe
    .exe windows:4 windows x86 arch:x86


    Headers

    Sections

  • symll.dll
    .dll windows:4 windows x86 arch:x86

    b44a14e3b9ff16ddb3179960d53917ee


    Headers

    Imports

    Exports

    Sections

  • 国服转私服.bat
  • 恢复以前的国服.bat
  • 水月魔力登录器.exe
    .exe windows:4 windows x86 arch:x86

    86fa49bfbcf7e5eecc3bddf2090ea894


    Headers

    Imports

    Sections