�u�j�r�p �M�9��z=P��Q��d�O���(Mr���b�_�Ƨ�@bK1,�s+�'l���¶�E�.T����@�k�Z)�~|'��#\ӡ�������ѲK=W�m�ĕ��V�(�g����r���[�����H�8qQ�sR>���Vr@�?���?��J,[��� ������70~d�����ȧ�����C5q��&z,%��a&��?qc�l��HW�u�}�&.���T��u��V��3���"�C�L��B���B9�_�|��?o�A�#J����ޖ"��fy�L%��-mP~��&2�Q���$�ވW� �R!}?� ~���%a�V��O�Ѷ��B�d A�]<��?���~�ᄇ����L���<�˿�n�ʲ�<�?b��f��]< _�'����Gҕ�^.`�Aҷ�{9h�:z�:.\�bh3��v�f������wð\����Sb٩�^��ˍ<�3�W3Y���Mo�Ͽ�~6x���W�\�+X�R�������Q��W�O<�gS�6ܢ���V�Q���a��"�J��;�Y�pv�����.rھ���Q!�p�ݩ��������m,X�#;g�x����X����;X ���\v�V��}~��Ը0~�t5*�>.�?�D��;� �^��h�,��� צ�����_�&��gbP�UhI��q��4�ٶ�n��.��&S�ĖnN9Ӝ�h?��cy^l�h C�n��(5�{���J��Ǐ�:>]L*n�!Ƶ}jWTBmX������<�v�ߑu������M��ǫW �D�+M���PZ�J2�y+����3f�>9�a��YH�(���n�T�Ω״�r/���K� �w��3^��4�V�u(����Q+�̔��k� ~�&K��!{א��V�o��86��=�;՚�ΆB�\L�I�Bz���nM�_�G��^F����H�'U��^I��c��^����ք��������|��c`������:�'*u2>\�/���>c�������R¢UW�b���4����L�et����������W���,"8U���i�gfa�@��)��A 2R3ɷ�J!&>���Ej������Z�U��7vMͩ��{��?J��&�Ng� U�2�f�el�Ґ��=�{B�/EU��`�� ���}羚����W$�&OdCMzW�և�#ĥ+tj�\B�� Dc�u+b%C����%o �1��̥�8��e)&��4����(��3{� Թ8 �B�mxt}$����N�'��A���@e;\���+t$�t��z�$` Ǭ�$B)1Lh���N�!Z�����= ����l���L��Ȋ�x;>n-[�Z��i�4�� �3��W��\�Pvɖ8�(= $��>|�W$+���к�_r]��fT��&�6���C�U^�t7A^���ӝ�.�m_o? ����H2i�^�nd}~���F!3f�Æ�HiWv����fў�����������x�lM���r�6���*s��i�ۻ���y���p�t��1��QE��ά�.���7�@w���%_O��{�u�M~L��@kJ���,�,�ɨ�o=R���H�������z�p �p�z��F��i�1ioa9�e�����/��9���T��WЉȉY�n�D��\qm:�}���h�փ�����Y�4��ˇb7[�uUߦc���F��L��$Ԋ��@�J�*WBR��'{i��;��=1�/�#��㔪�������/�$W|�pJа�|#.��i*Dzid��v絯(}��a_��C� o\����qZ�i*{���pJ<��^\�Mu& uDCt�@T���E<���Ğ���\2֦�$�g�S�r���g�����+*5_���{;�`-�T Q���D��A��?�_���qo������jӀ�M���]�Gn��<u�X�^����dcI�"�� $&L�hb��� �`�B����K��'�Nj��+�*3�-ۛ}��t �mt���Т�~(vED�Κj`8N�ߣx ��w�"�egObc[c�����&^K�X�<�Y3#��>r]�u�V�(���OGOw�E����'��n~[�2d]�~ǿ�/�>] �~Fu�.:�ے6?F�m�D�8�m_ ��������@Zs��/�_ ����H�P�|\a:��{���=���OG�۫�2�;�������/���nDf��EA��%F %SWc7Le��"�7QF��I��t}Vf%P��ч*�����+����kcX�� �x�c�@�{˫��O�h�h��xR0d����?$����O�8�HzuOm!��ɴPR`!fPň�w�|y�w]�ô���N���vO���<A)7� c���iuQ�i������<��+��ɦg��7�- ���i�|��s��A��N����n5�k�2i�n���ڜ{{B�ˈ�?eA�e� f���Z��boWNԻy/�B_��J*x���k2�����l8�v}ׂ��{vG [o�i���@�۲�&d��W'��qx��>,�lR��8rL���}D� �̩��]0����%�`&�ЧK!�ٰEΈII�lu���������.��s���<@��唲��|)A�����C��d �y�9[:zؠ!k%���ϜY������\�"�.Y�ZP^��}��ۈT��A���V)�+�U�s����h��̈́���zf7� .�dEI�xs�n��u{H���q�D��� ά�L��̖P�^;����>�ÞF����M����8��"����JT���,�0h 5nԐ⻖*��g�P����/��#��yp��h��"N��oL��,u��� �B�01f���F�o>�O���C6q'ȱ��@���,��x��0�n�6<�)�Ӧ��I��p��,��A� b�~�D$zk�8�_pU,(J9GJD���E}��uO��*�l%�M��úP1k��7�S��lb��wO��T��w�0��P�ߢY-�a�$�? ��P��� ����:qQ_V �j�(k����{�kݼ�u*��P/���9�'(�K8���4 ��b����.���Z�hM��Iٌ��]���&�
Static task
static1
Behavioral task
behavioral1
Sample
Gamersky_AliensCM18.1.0.Tr-LNG/AliensCM18+Tr-LNG.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Gamersky_AliensCM18.1.0.Tr-LNG/AliensCM18+Tr-LNG.exe
Resource
win10v2004-20240419-en
Behavioral task
behavioral3
Sample
Gamersky_AliensCM18.1.0.Tr-LNG/游民星空 Gamersky.com.url
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Gamersky_AliensCM18.1.0.Tr-LNG/游民星空 Gamersky.com.url
Resource
win10v2004-20240426-en
General
-
Target
0cff4c8beba12e77849f7e1f485392c4_JaffaCakes118
-
Size
1.7MB
-
MD5
0cff4c8beba12e77849f7e1f485392c4
-
SHA1
4d056a5ac9236e3f6634b2680dda6a0516a4b949
-
SHA256
f332cc46a1b20df0e52ff784cfdf66946f3d538ba8165c6dc24d77fd90027682
-
SHA512
9fe9c12a75dedd9ce270255fc9a3a08b5e1505f65c34ac7fb7126a1b6f2e27049939b710435e21f663e05c639b18ea2992a8c2a3a13e958771fecab1e9055e6d
-
SSDEEP
49152:IJiyI7wH163SK1ApiYSI88hFY49CdkOo2t+hw+gY:sH16H1SiqhbAdkOo2tvZY
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Gamersky_AliensCM18.1.0.Tr-LNG/AliensCM18+Tr-LNG.exe
Files
-
0cff4c8beba12e77849f7e1f485392c4_JaffaCakes118.rar
-
Gamersky_AliensCM18.1.0.Tr-LNG/AliensCM18+Tr-LNG.exe.exe windows:4 windows x86 arch:x86
272feb5317df0f29825085d1f172fde8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaVarAdd
kernel32
CloseHandle
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutGetPosition
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 949KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Gamersky_AliensCM18.1.0.Tr-LNG/下载说明.txt
-
Gamersky_AliensCM18.1.0.Tr-LNG/游民星空 Gamersky.com.url.url