t�����j\���|y\�o15��d�W�{�nqf���J.ИZ0r�[� x�?�-�{��l�75)g�t���C�"�Ǫ���w>��Y�F���\d6@Q�SH���Ӷ�!����15��w��=p��$�^�ag6�j$^/�S��䌄�i�P��W@��<���qY�����)i �ٰ�pJ���+�>UD�֞�( " dF���Ya�e�ur܃�� ymF�Jf�e�X�J�ue�;��1齋�X���g� l��o�҆���'Gk$͢O.�)R���ܞ�ֵ%PZs(�2���sݙF�_ ��A2��Q��A���M��� e���G����8��]��OƮ�� �� ���E1����s�W���nbp�I�5���q�ݮ�s�-��4=�l����&����k�+M�|�:� WG?*"���%�8�O�3���扵�Xm:3�)�[8��P֑�7� �j�����l�m�[��S�$��3[�Z�/�_�3P(�RO;���WA�� ܦy t��.�q/�Ԭքu�[�I�E�kO7��ӧ��@�m��)`��l�N�)���{��9���οK��:��|��ٍ��ɵ���ck�@tpɾ���[��2{�\S��^�IX�O\�sPU���C�M�D]@�lrE5e���ծ��@���է�KZ�2��?�������S�3��X��W������Y)u\p�Đ��A��n�6��LѴ��-�W��t���g�5��|ŗHg��V�<�~w}oSZ�M=�I�iG��h�/����` ��>D��K���Vj`�A�ǭ��{��� v ������;�QLh&��*�!@�aq.6��zK�V��<�9. �3�I�k&?X��C�:�3��ﻨ� ��o)�2z;{|�Q3q��R�a�������8bX�[@$�Ʈ��rC-�?�ͻ��Dc�s%bB��{ u���ƅx;hd��u,3��)u�a%�5{c"^ڰ���Cà��D�^�/O�[.CkF[���L�ٲ�o%��� t26q2��"��b �&pI3؋Ӭ_W���V��Q'<�9�xV��h2�K�)�=u�WW=t�(������N���#UQ[rR:I\�sL}�[�Y���SZ6�F�&6��r��1������B �?�~u��v.�s�V:���Ɣ�=�ux�v��G��Q���Ҽ�� vI~�8�[4��#�=�s�ɚ�,��U����eTc�b"4�<����X�����ޮ� Z&��=^�g3gQY��>����U� 2H�v�����Y� �^H<Rk)?������H cMa�ub1��u!��ظ7�����5�*e7��:H�̆DY+ʛ�H����)H�ӷ? jb���`�}�8������N�������x�)�հ�� z(jZ�s>���b���ߞ`p�z��J���s�� q���O�r�̎q��❉V�p��72��h0�P����?��,���e�p�K27^[ L'όPv�0a>�����5���K��QXx܁�Li��h� ��<�����:Kϛ�/.z�I�ـ���*���/�����N-�] i�SBt{�ΏAʝ$r���Z�uZ����0Q��en���� �@��S��6�Rt��n����r(2'��m��r�~˛����ϫ��S $��; ��1����[.;�{�� ��B̉�/3��ЯX�y��9n��%u8�(�顃d�KB���"4Sɚ;�+�M1Ob6����d���Q�h���EH?f��\v����R�.�"�c�) EUѝ����l����o��+=趥���D/j˟g�a8�Pm��%�����������,X9�� ��݀��E��Q�Z�[Ϝ�$;m5��k���|�!����5� DM0����^�_'A�ߎjؒ��*�����r���U��B�d�X�ed��3�g�]�%�_�;r��0�j�?l_G�\c�3��,����r`^[���kEj��w���M�K7�W��n����3\a�dEc���>8���t�.>�������j��������aX���{�y����~B�-eM�Y�+Yg>��n��)}*3| �����9}�X�����~�4XL�%q(���-�C �Υ���h,���G���AT����<C �i�u� S��Fi��ˁ�7P��r�7R�B'���h���>I 7����_/�V��I.��t�n�X�����H�3��{��8AE$-$�����P�q:�`]��;nz�]X�:&@~<=.`Z�IZ:Ȇ�Y�|i����}���k���p_P�7R�R��B.f�.P���#��(b�N�k&H!�P��` YP"Xw �G��XS��p���Wc�����m�1��-�������V� 68�{�2W��u�����������5ٟ")pap5 �Kq����-Ud��\�0��"�Nz���[�� \#p��ۧ��C�R#B�ͿLj��wYW��88�@�d.}�=��XCMW��0�%���$�"-<�_����+�\�����h��s~���[��\�A�X�'��}��ʬ�.���5n���� �� 82�K/I���ɸ<R��Bh�iny�>^;hf&���a�;�5i�7�l��L��v|�u��6w�eόlv����77�&�(&O��1d��:֯v�����N/��:����˹���0i��0M���r�l��?b�C��J����a�Sfr�����T�\�����W�/��x�X@2��j�7���\1�]*��)6i1ݙ�0����X�Y�X����>7M�nݲ M��͛@h�>��h��dlB�����<����;� �1�0�<�w�ʈ\9���a�������р=�`����3Д���6�w����K�@*Y+��,p�#^���䎖����Oڹϡ�}�I�d��٥�jmU�ux4"V\�/�Z��O/���Dj�hs�����|��P���g�QT���@�q.���h@_��_V�����]��E�f��¹�b��&�Z��Za8 �/8?��}�8gIib}��K���G�<sw�zFt�������3ko
Behavioral task
behavioral1
Sample
nyxplayerbeta.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
nyxplayerbeta.exe
Resource
win10v2004-20240802-en
General
-
Target
nyxplayerbeta.exe
-
Size
5.5MB
-
MD5
da43034f1e6f44e037fbbe0b04a6488c
-
SHA1
d4afae73f16f903b4555143df7808dc68e7af276
-
SHA256
300ab1908f1709de695eaee41f649237c9d5df88d1c74592fb201d84710f49ee
-
SHA512
e08e91c07bef146510b7d0140772aa4ba3a0b9ed6d265a6d2e5120082c7c272017e2e4e9086a1b5555011d7dbee7001f91ff6fdfccdb4acb18c70f1d2b9d40b8
-
SSDEEP
98304:RmMAJI4pAG6k7/UqtXZAQaAbqD5UaXf3JfEsYeMRVJaujCf5RP7Mt2r6Sac9n:8MAJnpAh872pvJfEUwpCPQQr6Pc9
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource nyxplayerbeta.exe
Files
-
nyxplayerbeta.exe.exe windows:6 windows x64 arch:x64
a89bdbb5ed415ad3d3ec6aed111c65bb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CloseHandle
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EmptyClipboard
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetUserNameA
msvcp140
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
ntdll
RtlLookupFunctionEntry
urlmon
URLOpenBlockingStreamA
ws2_32
htons
mswsock
GetAcceptExSockaddrs
wininet
InternetOpenA
vcruntime140
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
api-ms-win-crt-string-l1-1-0
iscntrl
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
round
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-time-l1-1-0
clock
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 386KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ