�f%=���Q� �l�[ `�/�� 1�b͚~̢�[�&��9�Zg���z�aIA���B^�9���h��'�����a8���%��*:G+����Z�V%��(��7H�G��;�٩�h�傂'� Ǿ��{�#�5 l"6+�RZ�怙�#̒�?�L8�(E�:���M%垇��>��K�aY6�m=�[Ԫ�&'b��]�C�U�F����9����ʫ�5��6���Y�#h#\�q� e��~e=�/s�f��-�V*�������힌�F*ٻ��y9%��{^����Ue�^J�JZ1S�٥���u�1q��2�Ш�XaD�M;:.`:J7i)W�9dβ�,�/��9ӵ�:N�p���=.�c� I�Gj.�� "-��J�{4�Ŏ��;�!������4����X��s)�m��Ӫ�*�^���%��EL�� �0E�#�A�'�:����)��6h�U�\�࢛)���k'��4�>���tTu��\��\bMx�x)��� ��Fo�[���0V�jx��R�4'�۹_K���LO�}Μ �uz��;������vh�����>"q�s.��o �EJ���C�wfô����@yQ@Z���_���@ �-1"k�!���f�[0��ex��)P�қ�빘��������kff�`u$qF�ٿқyefי4�(�z���4�|H���ٗ�I�Sl�퍏g��d��?:+t2������"`[bڜ����o\���.�N��L!n����3U�؋���r�3�ZNM�/g��%��զ�����������¡����ޝ+,W��L��%1�E2��Q�����g�,���@:�F`��Q-�H���_���څ�z���d�fT4J6\�\�Ӥ~�l��h=K����wz�k�D8�)CZnB�![|��$U��<��<�6k��/����@u?C������ZmZ%LT֊�Z�������bwM��\˜̞VZq���@ӈY����s�v�b�ΈI8���¼,̺r���*�NM�;D�F�E����o>��4�dm��U{��B&c��VGGT����y ��0��ɽ��F��\�6���{��/1Z+�=ʡ�:E�$̖���]���h��F�~p1����JTp����fc<�����@M��kΊ�ɍ:J�8���R�*�x�����ݙ��M�>��.������d�ݗ�� χӣ��@�fVT������\O� ߷Z�-IT�$�j�2��@C��u7bI�7%���Ҩ���+�O^�9D�=p�V��&!vT�7Ö�X�<�ʝ���0� t�-I��݉�a�&�.�B����B�XJD�M�3���G��fsq1 �/�duv�{ ��э4��]�a��^^+�$O��&�����D�TS�k���P�� 3!���)����������k[*����s8�jmD"'!,��.ɬ�ϓ=T���=b#�#�rk���ʉR냝P��a/�ݡAK�W��{+�DݐE/�g��@��i�;�1����]��@Uo��LM��� �����3��(��gT��h�X1ue#/�-�a�)�jp��[�/�E���>`����<0ţD4�j��*�������.,�O^؏oo�wr�ڝ��"!Fn�b:��o��� �;%��N�<փ��t<�)�fv�T3�[;g��PYtBo��[U�<��f^U�&��i�Aio?e�}�."$ Ў�4" ������N�/Kr�(�W75��K!�T;c��\2���z�m�qW�H+��Q~�����'��懯���8l���2h�/W3�u�I(B8���iP=E�ϼ~o� ��Y4�W^�am��x�u���R4����}�$ V�]��l�9�V���v:�j W���@�+�z��k�H@��`/7��r����[S��9�R��[q�^6�FW�H>�l�5x�?�0�N~h��ޒL�b�e�y��-~r�e�}��r�������]������M������q8�Z�@I�ՓR{8ݕ���X>��Ň�zz�fX�Gn�Oi�� �lP1��x/��ѳ�z^��9�d�r&��ޗ���E<܌�.s���&��wo��$rXM`u+ūHu��y�!�&ͧc_�Ƃ<*�� (-�������_P� �ƣ�����i=cc���o*Y�mX��)�xD��#Pas�}rBD��3/��.7�7?� �oHE�s_��#�����sH��p)�ŬnC=�v�!�jZ wՇ�ʸh�ywq�t����a6�ط��v�!Ľ!��j/R�te"^&����.�x��Q���ιF)V�2�S�>�[Ț��V�}�J�n4� Y_��ᗏPzM����SJ���FHT�o5�_zp@W_+�<��͜i���v ��\2���X�J��Ұ[�RHYRۥDwc�,-<�Ș� Gݡ���|2`0����S5��O���odz��t^���R�v�j�n�KRg X��D�[0�F ��5u� U,MOז���7�%�.�@�Q�Y�Q@v�xE����4J1�����B}��>9`�V�.t�B.n�j�y�6��!7���:)#��z_4�ۯ־�'Ύ1_3���G.�� u�iLa1����j�4���ʎ��2���G�^ �"��@�1v�.!E����h��#��u��T�Z�t|��Ȩh��X`U{�{��q����/�E��z5F!��J�߁9����@�R���*�O�/���I��!|X��%%�$ZH����� �I�V����]�h�����x��)�Ѥ�ݝv讙���g�4�������g��V�S7=��}��itcEi��]�� ��g��4]��]{J��uM���`~�����挓�{� ����JL�͎a���`i^& j�=��4�V�\��J��ń%��2l^�oD�7VO����ĵ��|�\QWQYHk���=&0�1Ob}����/���?9�w)2�,L��{2p�o�R� oB�����e�l �A4�ɬ�jw�iG���&��J�e� L_an|@���;Jr5?[�S����2���fxU�U�s��'8ŻtZ��tߩ @��*�Ew������c H%�j�T`����Ljm�d�Ŀ���
Behavioral task
behavioral1
Sample
ToxicCheats.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ToxicCheats.exe
Resource
win10v2004-20240419-en
General
-
Target
ToxicCheats.exe
-
Size
6.6MB
-
MD5
e7b660bf30b99cb0b2cf4a42c218861a
-
SHA1
8ad5b50c48b09de75770901b081c9c5cfa1e8914
-
SHA256
bad80912c475217eb4943488694c793e36e4a3af129f95e68b54c5d941b62f00
-
SHA512
0b7c7ea68aba8f6739e5f55ced0ee881a22c59a4cf37693dfdee71bf014dfc49ede3c972fbd1a77299b3941dc7c25e734f610a568f7a17c682ed60eb3012407c
-
SSDEEP
98304:oJlvHXufJocGVFAPx6JyH0I6rlLqu6qnvp7TX2Ic0SBygYCRPmbJm5Bp/bm5MkRx:Y8f0jAEJa0f7p2IBCgb05BdbkdR5OT
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ToxicCheats.exe
Files
-
ToxicCheats.exe.exe windows:6 windows x64 arch:x64
c2a5fc784a69b7731e96fd33958b663a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
WideCharToMultiByte
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
SetCursorPos
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shell32
ShellExecuteA
msvcp140
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
imm32
ImmGetContext
dwmapi
DwmExtendFrameIntoClientArea
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
normaliz
IdnToAscii
wldap32
ord30
crypt32
CertFreeCertificateContext
ws2_32
recv
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
strstr
api-ms-win-crt-stdio-l1-1-0
_wfopen
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
_resetstkoflw
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-math-l1-1-0
ceilf
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
api-ms-win-crt-time-l1-1-0
_time64
advapi32
CryptImportKey
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 317KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 695KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.6MB - Virtual size: 6.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 192B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ