�I(��nG`-���g:,?`"\���JZ4���Q|�GݕF�#a1'�q��;0�_^BMF�/o���, 2� � ӗ��?����6c�nV�p��i�7<T~��|?M`6n�*�D^F:���p��DC�^/e��I�^�����i��.z��ja!��8�j��Aq��1^3M��#�F�� �:�vv͎}�ՠ�b�{��m�ɂ�|R�~ܩ_e�*��s9��t ��tN4��K��] A� �adPOS1k����kl�0��s�e1��N�F7;���i��WjW J��eDEgu�~^��G�"I��pã��ċqZ�<?�p)��J���v�<��$kL |� jM7��c�v͑ͳ֚�E=�\���;�e��p8ge<��0%��CE�.�S�X]�g���m��owN�t�s�r���b��"�qJ�"(�x9en��9�*���jItټS4�/����R���gp]�k�/"4>s�����_�^��P��ÆyBvA"���6��,��� ��S�q��G�5���"��am�K`�X��:�� kp�v���#y��;$�|�p��O̧We��:��5]�¬4�C� =�n2����n��8��`���%�3,�pq�lb �%:�r�c�[*��Q5#����h〕��Vt���ʦ�*x!;�����MS/�,��MZ�^K�|3 �!/� ����O��n{�M43j{�s�+�><'˼�B\��I�*��D3��� ڏ}�Wz��kن�7����3�B ���Xgze\�f ���$7D��,�������N7\1nT��J�F�kG��f�-?��*�6��)i����ST���)Gc3����#/NZP�p�{�f�eO�ԏvP�n�{��CM�sB��Dh��Q��������<��Y� n,������z>늵�b�4�H�k���c�j �Gɝ�������P����^�o%��]V�;ʻ�D�r�f{&�]��`�P�ẁ0n�<{�Hx�;w�k1a�X�XTij�;���L)�Y5/��%t���X:U��wr�Q�& LT���)�WBj{�h��;��/�Otk�Үd�R]~7>�;�YV�\c�5��y����l��W\��;���r۪ۚ��X�҃��� �re��d�J%?�����$��!ζS�#�O�Gj�D%uGV�r�P��~0���m#U)�R�w9IW�r���p����s]��bi�M�0Г���t�>E0�,d��%u�1.9V=�S��ߤ��QGn���)����� �������i�S k�9E�O7�3YAk�l�8������O�?%�� sz1F}#�/���ߵ��b���Wa�w뫎ey�B����O$*Ȗ��C �[A^O&B��T��TJ��!�T���U��W��,q!��O��2�����R��FvWKKь�cDu{롥�\�^dm����{4i�Yy=e]���'�5"�̠�b}&O,to�V` h�3q��ׇ���fK3�c���x��)S''��pBy̶���Y�_?:4*���vn�M6��q�rHk�*��u����5�w!��o�������,�q��nHj�9>U�����s���f�rz��`��r�i'�*WB<U�zVz]b��&p�����)��+�5P�1����O(�(�fV)T�AD�a�I�N��%�����w %�Li{���sh�.��&�~�sb����s;���Ag��bpJ�A�@z����^Q{���ݍ^@rr�M���bX_]Cp�w)�ӄ�T��(��[�W�����*7�?�ݶ���"�h�����f�<I���w��M�]]eנ2�S��5aK�4)MX�xB�6L����W�J6��T�:��)6ׁvZ��;��~���bm�A'�&������@|�ղ�jv�`���a{��I���ؒ͞�?ըrG��q�h�s��\�D��a� 0Q�TQ��u��j7�Ĵ�O1�>�\���s�����NɥHd�k�\#��W �,u5O��2H�a�0���zey� JuW��3�<�5��Ř;��j�� GL����ʛ+ʃ�S`U�����h&T��A�qD��9�����\ި:�'2]`�x�~�S�˨^�#ƺ��s��3.�t�[��5�� �rE����^����xWi�pIV(H<poMs+Pć:��u���c|��=b���)�w��a�1_;p�]��k��Kф�������M:�R�g�r�ǖo�Hi��r�r�p#(�jT^�D��������X϶�0y�����]dMʍ�l��r%�ӊ����b�v�RfX��U%d&��F���-L�ٯ!�VC�>���-m��d��r��?�o���4\X���Y���S�:�Q�W�'M��u:�"`��`�ۮ����� ���_�7kfxT�����O��m������a�z�P1& 8�a�z]�]v�i�2]R�bA^���y�!���-k���4x'EQ����a���r?�;9_K��>RZ���Q�2��"��͇�S���k�ԕ�\�a�b�I�#��N�\������{G\��p=����i���^�\�:YW�P�E+�N~*YmF�t�*?im,�w��ڶ~�m�Sfz:SS��!� h�6��+W/��_Kl<3Q@+���Fm_EZI2�1C� �vo��ֈ㰪+'DM��U֝X��~I�-c݃��!>~'�2Q�f�Z����ps�_uV�����j�2���ɝ �ֈ$(�a}�¯�lyc�[0#���.ذ�+Rg�����)��\2IS�6'k\u���q@�o+�R��vX�þ<��`���ײ]���sh��CXC�2<�AO�f<(u��f��}����ڿ�?�W&L�u%%@���}u騅+�|���ʿ�J�:2���5\�Am�7|�4�Rq"�8�֍� D���`��B��|)1)�5�1b��[�/���"%���ɘ �(��O�qu ��x%��9G1>�A�L�����L�ɫ�^p�M�%Z���%ŜA��Tj��<���}�GqVV��k�����eQ|t�i�W�p ���T�9 篤Y�]���<����dP�������'v
Static task
static1
Behavioral task
behavioral1
Sample
Gamersky_SleepD.v1.8.20Tr.LNG/SleepD+20Tr-LNG.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Gamersky_SleepD.v1.8.20Tr.LNG/SleepD+20Tr-LNG.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Gamersky_SleepD.v1.8.20Tr.LNG/游民星空 Gamersky.com.url
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
Gamersky_SleepD.v1.8.20Tr.LNG/游民星空 Gamersky.com.url
Resource
win10v2004-20240508-en
General
-
Target
b08bebdce484bd3e141f7cc107c3045f_JaffaCakes118
-
Size
2.0MB
-
MD5
b08bebdce484bd3e141f7cc107c3045f
-
SHA1
01934dcf026395358a01e7dac27c37a5515b4cc0
-
SHA256
f74594bb5cd092ff101eef8f966baf6e2bf44a12ad083df60781af0eb98542b4
-
SHA512
a54c0f7cf448e542d7f448f1a105d3f93c8ec76c9f5ef9e4002e631a3e1921014781316969719380c718b6c24a2ad7e55f879fba437340e2ac7bac81af4fb138
-
SSDEEP
49152:XR4Xl8K8vKgrEZ6QvTtxSdkwQFQrTXyGABe42XemSCy1NKSuZyo6:B4XlvOVrEZFvTtcdnQYX18e42XXy1MSB
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Gamersky_SleepD.v1.8.20Tr.LNG/SleepD+20Tr-LNG.exe
Files
-
b08bebdce484bd3e141f7cc107c3045f_JaffaCakes118.rar
-
Gamersky_SleepD.v1.8.20Tr.LNG/SleepD+20Tr-LNG - I.N.F.O.txt
-
Gamersky_SleepD.v1.8.20Tr.LNG/SleepD+20Tr-LNG.exe.exe windows:4 windows x86 arch:x86
0ccdcfe933b42c62aaa394bb593ca045
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
_adj_fdiv_m16i
kernel32
HeapDestroy
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutReset
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 942KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Gamersky_SleepD.v1.8.20Tr.LNG/VERY IMPORTANT!.txt
-
Gamersky_SleepD.v1.8.20Tr.LNG/下载说明.txt
-
Gamersky_SleepD.v1.8.20Tr.LNG/游民星空 Gamersky.com.url.url