aww man, looking around to see if anyone has already done some reversing/modding work on a game that's piqued my interest recently has led me to this itch account using the blog feature to redirect to fake downloads.
httpX://itch[.]io/blog/1318716/hollow-knight-silksong-mod-menu-software-for-pc-control-
Initial landing page: gitcompiler[.]com, appears to call out and test 3 sub domains to redirect to which in turn will send to a landing page. (though 2 of the domains have busted cors rules and don't work anyway)
Interestingly I was only able to download the sample on my linux machine by using the "responsive mode" emulating a mobile device in firefox for the (purpose of User Agent spoofing). Anyrun and virustotal didn't pick anything up, but another user got some signals using the recorded future sandbox under a different download.
As much as I'd love to try and dig at it myself to practice some reversing I don't have the setup here to do anything of the sort safely
reuploaded sample: https://app.any.run/tasks/5ee02578-a655-4559-8dc9-899b40f5ea57
sample from malicious host: https://app.any.run/tasks/eb5dc590-a83a-4a38-afab-6e419ce99686
public sandbox: https://tria.ge/260117-qf18ysat4c
https://www.virustotal.com/gui/file/f6dfc06fb7fa8e733ae7b2541d7b1771cd1b6d11984b97f636a9ac47e23ad811/community
#iocs #itch
// Primary landing page
*.gitcompiler[.]com
// Redirect mirrors, contains an AES encrypted url in /head/meta[name='token']
httpX://digitalwavesway[.]com
httpX://gametolifeservers[.]com
httpX://techflowtime[.]com
// landing page for digitalwavesway
httpX://mailer.soham-sn[.]com/
// redirects to this anon filehost for applicable UAs
httpX://download.us-east-1.fromsmash[.]co/transfer/o__j34ymsr-et/file/57f99acc7c450b6d46375299cfea313a04b5c9d2?identity=a3aa69c86700fc05b854066a0e9dc0c5-46a18736882df635ff3cb7ed43d39ba05859a992c5ec0d2b7ef47c8d99fc4de6c7884d5fcf7019eafa90291a05c7421c3ef7b7b78d70fbcdced31f8a3b50dec16c04299c9ea69377415fe2a33d26899c&Expires=1768719805&Key-Pair-Id=APKAIM76HR2FWFZRN3HA&Signature=eG9gFcmZF2zZXoRTPyWemG0syj4bEbtNOitCECgcjF-XyQzUb6i9skCN~9pKcSr0n31JPfnCbfSytbNS1MdgsbQH5kpxQQthp4bhK38Xqmbsd~Gc-VgT7M~3ml7K0H1uiPrvd8eu7oWTWEaUJJjyAn-ZbqAVRSD99AjhJ8O~yWD49~nlYowUR0fO7R-gPtNd1BtB278xB3DdW0js1M2os8T5AwIULZKOW3-oDjMhrAXCfqzwGOrH8GxNyJpA09sP8ZBWvDOb73ykYWb47~UZPBLV0T2hnWGkDW5ZHoKhZUwedrankpheTBG51DeSM81OZi3ZPOEbngtGZDvtIYQtEg__