>R"��s�8�������Oٽ�X�J���R ��P�/85�܅�(ލ�=���NY�ٮw�^"={� ���i�f��1t��1���'�M��C����\]t���K[�*[�M�*e�ߟ��z��Q;���O�re�OJ�S06�ZyV.�g_gk�tĻ� �sD_��x��d�F��k�#������ߦ��ܷ��+,�W�<� +s<�$ί�ԫ�2��<A�9\.TpA���1�����&(�h T,v��7���T�"8�����/�4uܴ!�6i�s��#V�z7��Һ�j���ޜ$4"���L���u��1�Ib�����ܨ�ag���-ł�8�⯡26 $����>�q��L���c����$�w��a]����R]��N��`����zVk�ن�s��y��/{>]t�ʿO��wi�������W)�m��=~��3IuT�N�`�ȁȏ��~��@`|�F�N�Xe�=���&�����f�b�f��]�iQ�v�`��Ex}�mq���k�tG4ZR���U��5���nóMT�i iҺ�� |���}ly��yv2Š,�u���nf٬������_��gi�.O�粡m�JCj�9�����`T栦)�����6��!V��0�'9������Rs٠��A���;J�� !��+X�~bP!j��"����� ����f��D��s��j���k��nyJ��4x�w�Z���w%W��xyg�#d����������W�}�r�5�ϑW,1�[Wɏ����M��6��h+�JJ��1�,��O��};�wN�'�˲�y�]����ђ#��z{�\ �,l6"#}?�C�}���_���`�[������(�fb3�;�9�����E�����I�bd��Q��T�g�X��l؏*��`��W�}��X"��/���>�����_��Ta�n��V��i��*߃���&�{s}SYѦ�y{pI�5h�����r?g� ���/)�y��(�q ���z|��{؆��>�Ӡj�-���vV�d�Ԫ���c��AoNT�x!��%G Ě(�����!�N����B� e??Eϋhy�M�Q�1$�6� NɅFlB�r��}�w�7=��/$m��9�tZ���6��]���e{k��B�؊iZ�l�%��[�ړ�N��|k{��^��dب���9����?I_�����Uzn��5��-[^'�DwL�-6||Ϥ�2��}H� b�sR�,��;���N�ʫe0�\�l��A�9�b�4s�s2��`�Gۍ��+�J�Ԩ�=$��d���V\f2oll˝}���h"��@�c��8�~]�������<Fٖ����(�A�N�Ӊ�4�ȴb$?vtr�7�o��_%#��Q�Td��k>M��S�5������:��&]{�9g�h`�H>ZY;����O��[�$A^�5�?.�Z|l�tط�� E��A�v�^��Т�[�aш��6�`�#Z .�1t��!�J�S=�q�jC$"/�GԘ����O�ʍ�D4GCj:�Q5����r�)�~����I�9~@awv���NWp�[S���}E PWo�֙�X`ʥ34�k�dT��x���&6D^pIF�%ڲ7j������1ٌ�LƉ�i���r// .3�Sَ��\����":�J{�.��s�H�P�<�*1|�>n.�㐿3J��]�:��1�� �n.۹���T��Z�s�ԟu�B w�N�i�^%��h�`�Vs���5��?~��3���C.w]|�/�E8<��H�����UCZǗ��!ǽ@]���.H.v�1ii�����e�� *+ ��n�]��]���I��c��~Ϊݮ ��������nۿZ�0��� �'���c)��*��,]L��d6eg�+��?]/�nN#ʯR��f3���J',��Zv,7�̈́y�C4�6���@D���VsK'�j� ��:UU���Eڍ�(%��V�u��V��ʱD����ؤ=W��ڧ�<z}�G@�����P$�,p��=᫁Q^�����a.�X��5%�"J��<�������1�4 ��ǰG�<����b0 i�2���_���h�`}�۶X9|�Y��r6&�U9mҁb�8$�j<�bQmށ��}a���v�je����:����>��.)t�6s�6�!�/g��bc�����Z��%ԍ"M\�N �}Ü��ҵ,�U�ȯ�p�@���� e����]�c���x*ll���:�͈����/N2N��Î����9�[ʎ#Ighob��� [���`�r���Cc�!V<���N�7�~�I:��k�Đ.���u������HE<l@s��'��V�x�_�)�t"_�B4��u,�~�@6r����oPAPޓ[����H�'^�h�!�1d;2)�b�6�W�Ph��Z/�xM0�5��ʈ*=ȓ� ��3i��%W�>�߁'o,�j6��%,/ v�p\6GiBH���Ų��-E�ET�/�{���ߺF���cp��[���Pdo��˻�����p�-�)�m�e����ѽG"����0>���Py�I�K<�P˕�D`�0���"��~������9*]FԌGgt��y@y�Q���o�$.-݃5"�2���4/GF�je�e�C��4��ߋ9�����^fv�x顀����u} �#t��8����r�Hn�qL��DƯ��L;M/2�]�_դ_Q��&��h0���@�D�n�9'��&�Vil��*���ꖠ�G�@ 5im�?�7*R�j���C=+|�|�x�ڱ�p5]��2�V��<�B|��j�,l}Z ��(�1Q�D�)3r��Ȳ-����ڞM��M,��S0���fE����;|�S��1�\�3��e����;��Wb���n\ɿ��?̗&����gI�b�U�4�R�<�.�����H ����}�Z�8L�"ڒR�n�P�6b_��&�z��U�Cm�Я�a=Wٶ� ���g>9xٕ\|����KJq{mk��N|��NK�g�OL(e�r�:r��� ;2|��/��t�e�������ԑmJ3Ԗ��h�+���c͕c��4"�R��݁G���ِEe\��� �`
Behavioral task
behavioral1
Sample
nyxplayerbeta.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
nyxplayerbeta.exe
Resource
win10v2004-20240802-en
General
-
Target
nyxplayerbeta.exe
-
Size
5.6MB
-
MD5
4ba14b615183ce04bdf4b33e6e465e22
-
SHA1
c7ab447c31e6753b59798a61e95b306383043c49
-
SHA256
9ae94d57928a86b8266be78a4c1246b97c186cd29a0833133a3609f08117db7f
-
SHA512
b1e32ac8b314e6998b187aa85b5db14fefc7f7664bd33cdd8a24937196822ae740f9fd840823826c6785293bbf43247c5040c1769aa7a05d55e1dfca97b5b9e4
-
SSDEEP
98304:7GF7hL6UvUbSFEhTgTvo494PlMFHvGRmM0McwM2J08s7qokdmNm+A:7GH6mUkGMTvo494GHvGWwX/B5l+
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource nyxplayerbeta.exe
Files
-
nyxplayerbeta.exe.exe windows:6 windows x64 arch:x64
Password: AROLA1234.
a89bdbb5ed415ad3d3ec6aed111c65bb
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
CloseHandle
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EmptyClipboard
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
advapi32
GetUserNameA
msvcp140
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
ntdll
RtlLookupFunctionEntry
urlmon
URLOpenBlockingStreamA
ws2_32
htons
mswsock
GetAcceptExSockaddrs
wininet
InternetOpenA
vcruntime140
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
api-ms-win-crt-string-l1-1-0
iscntrl
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-math-l1-1-0
round
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-time-l1-1-0
clock
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 1.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 386KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ