��u�wK'�2�� ,{�d��YMyz�p�rh铱Sv|C4��� [�L�|������Cm�'�G+���Q�ܟK��<�L%1X�!P�C��Z�p~ځκ����TZ�UPa~���K���3v&��1j�d=NN�Rc*\�mц��^�a���A��;�������;���no������L]1K��W�g#��Ia���<�Y�ph/�%L�Q���9-���b�.-��^{�lH��4ii��V>�� `�A.@�o������������;�'SMN�a�7\,�����7!��WN�%.H�T;p��k��Z�8�$_���QQ��z��%E��Ny>1�>8]�K%�Bᝒ9��تÒ'��za��Ni�yӝA�c�u@s�����]�$]8��vs�K�K�-�I ;��a0�� ��v/Xٴ$���j�Iׂԉ��%d�Wya?ImT�8��;k]p���:� :@0�I�V�uG��z�Z;lAOr�8��$�-"zA�~�-i��I���(��F�h{��\Aw�Ǝ�*�*sj�Rg*R��菓6 �ǣrC���vf��P�C�:����7H�^��R�%V"�3���x�% �[�ޕ1��ӎ<ҙ��+��N�A���_@cv ļz�Z��*/Pw�L]��Z~�SFn�By����H�_�q�C�[㫚��I���Ru��Hv���N�-�s8ֹ⣨ǫ-��#�G��ԩld�Tp��(+�-����lUB�yFj�<��y@ �!��X��nFyWz����8̜�.i�$w�<�<���?��%#�����&�ʦd����H��zy�t��z�z�[�������/��������T���I�_��N|<w������I�����Y���P���k2�+f�Q��1b�ɢw�IvU����������2��D���>l���F̚��q/ 2�i�/�չ�������%��[cݺ?�{�� ��#�| j��S�������/�Hu��ۘ�l����٢�k<�9�1���Iǒ�gU����)�F�}ퟃ�f���_�R�@/PF:��F���j���Y&f��7�E$��$���0</T����K۷�T�q�T�w`r� &�Ƨ� �y@���iM�5)��U9וi��&�Z>�,uzP� �x�ֳu{Vi��(��G<4f���B������F�֏��Y��|^��ْ�^!f�x9���b3�e=u���z���������}Xk��s��8�)��@e�?������?��O>���^�"��䟿д48Ȍ��L\�^r_ �ɭK��~iAC�Aq'��)���;��/���PWm�-0U�/4��av����m����.!��To,�FS)��� R��0�LRW �C1�|��c[��q4�t'�f�Dx��t}���"\������N>�ϋAl�,����YL[U9�1{HCi�9Y�za���� ��#�[Ǎn�cv�=D���,X��o�s�!�&;:y){�N���O������G�A��{�Ip/��8�I�3р���]��O�K�t���:"��$K&�ӿ�����JuB�H�]U��@×Mo���"��� :&��$���R���i�ޮR�Z�7�Z�#x�FqU\��$gb�߮�,�d�gd��Z(���t���3z����U/�%�𤙩��m�WIO�3z��<Z\��DI�TǖFƟ���$���z%=�ۀH��3/n��N��M�|@�5���>8){>�8-/����p�v � ���u�m@j]F���z�nf�e�7��� bh*9gY2ϲ.����^��מ� ���l�hKt`��:�v�5���5��^�J���~.��������W �G��`'Ŧ8*�Q!&��L�TтQ�)���[4� ��w�yۿ4��+��E~�u��L�-�M��:_��]䰅�{�G"�D�|��O[�b�š��m.M�Ww��z������D���Д�%��\c��ߧբ�n��Q�bK�r��d����B���(�hH��Qi��u��n�(���P�ɽY?�Gk2G�O���מּ�.��xsi�̄�>� o�]֔"C��Y5����wmK�W�?��L��O��!?�Jm��Ā�� ���v}�%�����y�%��Ǎ��2 ��s�~f�Ѷ�(Lz�� ɸ-|7� �k!���<�����+5���V���r'����b� ˙w�ĭl���n���E����/n����"���t��͂��H�o� ӵ-�~��CH �r���x��0��` ������%l9�M��J..R�V9���J}-u�q����xS����mMbg���4��7�j���F�!��H��l����ǝ8�u��_�����Ĝ7�3 �D������R&��8�)�����kuѹ!�Ս����ئF��`4���ßT����4"����j�E���p7�-V� �:n\���W�(_jT�]���lY��m�FX70�� ̓8�q�1#S?��E��B�)�����26��6CX� �&O4�t�>겟�<ҭ��ɗ �|iƏf� �<~;Og��Tk&�?�{�±"�lF�b{���e ו=q�KJ@O�q��^حx���[�"������&ux(ҿ�ʳ�������Q@-uq�a�s>����$�m���g���b����F�������|���|�~f��S{>(���^Sc���`��Is�p&Ї�ۛ����~�i��(�' ����ɯq>�J�|]��k�:`�B���Js��/�v���G�w�*Wj瓶�� ���"Ү��PM1�U�=4�a�d/Ι�^DD�Ȯȕ[������*�uKܨV��tͲ���V�|�R�9�U��0�P���Q��S�.�X���-��`��/HƷ��3d��) �A�1�x�f��1��4#[�0�.D��6�̳� O�aQ���y��鼭��'�oE�ם6��}��T����@\/��d���x>6�z��º �Z�����s:��ךgC��j�`ܗe�7�x�w�����6 ot�F�|_�R��YU��+�B]3��M�z. }S�ȁ2�u�r���#�4zQAFz?�����Fa�"k���6���b���e
Static task
static1
Behavioral task
behavioral1
Sample
Gamersky_SleepD.20Tr-LNG_v2.0.434913/SleepD+20Tr-LNG.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
Gamersky_SleepD.20Tr-LNG_v2.0.434913/SleepD+20Tr-LNG.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
Gamersky_SleepD.20Tr-LNG_v2.0.434913/游民星空 Gamersky.com.url
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
Gamersky_SleepD.20Tr-LNG_v2.0.434913/游民星空 Gamersky.com.url
Resource
win10v2004-20240611-en
General
-
Target
b3eaf96b103223387581697283c5cc95_JaffaCakes118
-
Size
1.9MB
-
MD5
b3eaf96b103223387581697283c5cc95
-
SHA1
338c049101d51230e4da7e2791fce66eef415456
-
SHA256
9d37d5e8fe86544f12474349d105476fa702cb62b2b9623998aef68f542186a7
-
SHA512
9c2f34260eeea3f138d35ed470e7a443d4e6baecc557ad1a97bfd5fd97f7c23974e54a80aaeac6490d7a36a49f14ec148a9bbc1e95cfff54d6edef4de9f2ec4d
-
SSDEEP
49152:DE478qsK8CSIFZIVXIFdilgbo7JjFxCOLpwtYIVDRRIUb5062:tTs0SCmV4ggbWKOCtFlIUb5e
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Gamersky_SleepD.20Tr-LNG_v2.0.434913/SleepD+20Tr-LNG.exe
Files
-
b3eaf96b103223387581697283c5cc95_JaffaCakes118.rar
-
Gamersky_SleepD.20Tr-LNG_v2.0.434913/SleepD+20Tr-LNG - I.N.F.O.txt
-
Gamersky_SleepD.20Tr-LNG_v2.0.434913/SleepD+20Tr-LNG.exe.exe windows:4 windows x86 arch:x86
da1f1622a375bdb7832260418745bfc6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
__vbaFreeStrList
kernel32
SetThreadPriority
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
winmm
waveOutClose
user32
MessageBoxA
Exports
Exports
Sections
.text Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 21KB - Virtual size: 942KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.VCrypt0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
.tls Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.VCrypt1 Size: 2.0MB - Virtual size: 2.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Gamersky_SleepD.20Tr-LNG_v2.0.434913/VERY IMPORTANT!.txt
-
Gamersky_SleepD.20Tr-LNG_v2.0.434913/下载说明.txt
-
Gamersky_SleepD.20Tr-LNG_v2.0.434913/游民星空 Gamersky.com.url.url