�a�\_sw���4 I[g��|>�L[BZHk�A+�^��S�I��I1�M�r��/�'��`�v�f�.F�v�7�����װ��e��0-2pFp�$����%yKi�����ř�nA��z�=m~�� ,�_`�@_҄�+k��!�J52=Y;O�0=�qEl��z���<ٮ�( 'g�b1aS2��r��܁Mg�$�6H��n�k���^�hKkҋ���{�D_#��BZ+� ���~�����{|�I��R���C\="]�G�9�U��u������U����������m>��0����C���Bl.i�Qb�O9��-����k[�@���Ihv���U5!i����~-a�/�MDQ"r�ϑ:��?�4��]�Ԁ X��-Ҳ���)#��ȁ�rV@��{.TC�����J_;V�R�\o;"e�tK+�X�����o%��ͥ����n�Aį�����o��j��)�hi�A/G�a�4.U#��`k��4�|a���g��&p�@eW*�����'U�2K]�;d�M��յI��Jꄧn���/�<-���������q:�,,�LT�����v�Y^��|�1_�g4ީ�'C��giI����%:��W�,�N���,�����Ώ~f31�ۚ"�n�\}'�w/�&��];�#��\1� Th�(��7�3�2����5浕���*���Hn��k�]_����+/�/��5��G�l{H(��d-O�S�K����K� F�m䚹|�73c6�|���������6�!���Z0dѹ�l��clm �*-���6\%dT��;�[��T�o���x���?I�w��te�l�%�ھ!�ϱP�=<�#J��K#I����g7��� �&�{A�Q��{Iԁy�՞E��[�oO�֘����k��Ud X��n_H���k��H������������7���[l��z$���!�d�ąSaª����Q�3��=��'�/E�U�q�\5l��#��m���!�%=y�i6��n"E��ި�y���*Q�������,okI�{��B����Z��E>�-�l=9��xb��us(�1u=���;�aᛀ�� `�S?��k�6f�D7��~���"���L�{��O?�S�!����LO���z\�Q�xN_A�M�o2&��k�����������[@���ԛ���e��]`��r���BB�M Y Am�6X���i8`gm��.dܒ��cu�?_'��l�Hu'c7>����m?�3�6�Zޒ�eٽ����A��ozT���""��gY��� ����S��a���R�i��h��;K{�[�w�D�����X����Zp�/є|w[����/M��۟Ĺ��;�J�v�����[=Y���\�ʞ o|�k^��ǀ�λ9��F��W<�;æ/d���L��2<��2[�r� 2��xg��d!��3s�aXiL��(��� �ׯ����!Q����v�ޤ�ff�C�������v�CmgK�g���m�q��2�p�6hFBdq������8m�: �v!�i�����N6� =�"(��岲p�������Q�0����C>�����~*�]�\R���ٍc�[�M:�g:x-q�E���.�\���HTQ����U.��L�Bez'o;��]�n,�]�o�g�����#�e��g��|qٰ����}n��������N��s0x�a��d��$�D&�v�f��.�uP��±�i��& 7���ơ��ט;�m2j�T��M��_�9����� �t�u�X����ta�b��r^Ch�F��Ȟ_?�"<�H���d���w����� ���x0�xWTɰ�j|�{=��hrB��݄07�a�ܣ0Ni�X�%�F�w1��Hl�;��O���< 4stf��K��ؼ�ɮ�Z8� ������ ǖj�:�?�\Ņ�e,?�SZ�q�s�l�l�0�M�4/���N�+Q����o���ܷ���B��ڹh��� do�s�6�w� Y��L�}Y��x��|2��A"�?�����(����t��x@0`8L�<)5��F��"�������h��ؓ5=�m�3앎&�r�J����N��-s����l�0:K�f"�s]� ���w �������������������b�6�9T�)#�+w9�؈�n�ş���!�pe�&�S3'�9�uF��q����c���spN#\;y;PQ��:�S�:����-�D��JT��l���~�� �ťe=��z�R�D%p<�!�z4 U��V�J �����(�_��ARCu7 �.�w8��� aA�Ǭ>���O\h���wcln�-�$�\N�H�[��D�&y=jZ|�j���Mm�~��^h)L�bR}Z$���(l������ta���Wv�#�W���f��::���_��6h�(���nr���Njlf��ȞsX�����q�>x7�%+!#��p��%�b���f��Z���Kp0M*�8�7 ����;�?���������\\�S1�?nr��i������]��vA�?\����d�5����{�u���Ъ6���(�Y�A�T�w��H+����DƒL�ᚁR�"6�A�?�H=*��>n�2������0��K[$pj�����Q:�[c�j-2�d����~�<�#$Q���Ŧ��Q�5%�Hل�1�w��ɷ�L��J��i��1n+��Uy ^`wr']b,��0�1���)D|�Ȟ��*��貙��0��#_����1�z@�Wg���T�k�2���(`u_�m��� \���m;|j�U������ gr�T����/gq���$��w�g*��~�iV2:�*Sj*�=e!rs �86aZ��S���Ry�o�x_�0�1�_���J}��i����7���ԕMѳ�&8���=&�[8.Q�]�v�!alpꢭB){h&�f��d�C��M��nm�br��^` h�2:k���3���Ԍ����v(E��=k11ۥ��FrCg(Ԡ �u6W�5[5�s,Pk�6��U������^�u�eMEZ�&@X5��T����A3�v�]@?����p�$�� I��tW�e]U�t
Static task
static1
Behavioral task
behavioral1
Sample
Gamersky_AliensCM18Tr-LNG_v1.0.174/AliensCM18+Tr-LNG_v1.0.174.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Gamersky_AliensCM18Tr-LNG_v1.0.174/AliensCM18+Tr-LNG_v1.0.174.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Gamersky_AliensCM18Tr-LNG_v1.0.174/游民星空 Gamersky.com.url
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
Gamersky_AliensCM18Tr-LNG_v1.0.174/游民星空 Gamersky.com.url
Resource
win10v2004-20240226-en
General
-
Target
9d9d8f487b3d33a537c23deeb419589b_JaffaCakes118
-
Size
1.7MB
-
MD5
9d9d8f487b3d33a537c23deeb419589b
-
SHA1
85869adbdbe840a023aa7328928d44204695d470
-
SHA256
3e9251d986985867c3bda9b8adaf5b86523bc042320ff649f36a936a0a51eeb2
-
SHA512
f92b84e8095de1245edcd7fbade9e09ba61e9204d8b065c9bb4ac24f0c7cd0385a8d32e31dbc42d23ff65889746834f739e58e82367704c02ad948b3c71cd594
-
SSDEEP
49152:vvJB6ItZ60zU792+e8M5VqAtxXCXtz4dCi6gq/s:vvJlfxG28M5VqalCdMp6Rs
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Gamersky_AliensCM18Tr-LNG_v1.0.174/AliensCM18+Tr-LNG_v1.0.174.exe
Files
-
9d9d8f487b3d33a537c23deeb419589b_JaffaCakes118.rar
-
Gamersky_AliensCM18Tr-LNG_v1.0.174/AliensCM18+Tr-LNG - I.N.F.O.txt
-
Gamersky_AliensCM18Tr-LNG_v1.0.174/AliensCM18+Tr-LNG_v1.0.174.exe.exe windows:4 windows x86 arch:x86
cf8a6c80a82fc6bb341a6a23d5fdaec5
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord717
kernel32
CreateThread
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutClose
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 949KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 1.7MB - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Gamersky_AliensCM18Tr-LNG_v1.0.174/VERY IMPORTANT!.txt
-
Gamersky_AliensCM18Tr-LNG_v1.0.174/下载说明.txt
-
Gamersky_AliensCM18Tr-LNG_v1.0.174/游民星空 Gamersky.com.url.url