General

  • Target

    Install VALORANT.exe

  • Size

    67.5MB

  • Sample

    230423-zcb94ahd4s

  • MD5

    adfecda2e19ec6a99692541e53cc1738

  • SHA1

    19e10b41a677187eb4ebcc2f823b206bbc6d0692

  • SHA256

    4e00fa7978fa46f7dc4d89d65c3864003cb2e57bb55fbae2712c3b4faf8d3d02

  • SHA512

    e252de4ad52dc8d12db7bbb8057d03cbe2a13eb7d8948e5c3941720be7e44281cb28d4054d91bbf82a438460c0ca8a0e7fe3019f9f0326a89742a6e2d8dd673c

  • SSDEEP

    1572864:QrNItDfUCSp8K0UNl/Ywrt9E7lzPF5KBBhDIVIbjUp1xDV:QeDfUBp8KnAtqBBhDIVNjB

Malware Config

Targets

    • Target

      Install VALORANT.exe

    • Size

      67.5MB

    • MD5

      adfecda2e19ec6a99692541e53cc1738

    • SHA1

      19e10b41a677187eb4ebcc2f823b206bbc6d0692

    • SHA256

      4e00fa7978fa46f7dc4d89d65c3864003cb2e57bb55fbae2712c3b4faf8d3d02

    • SHA512

      e252de4ad52dc8d12db7bbb8057d03cbe2a13eb7d8948e5c3941720be7e44281cb28d4054d91bbf82a438460c0ca8a0e7fe3019f9f0326a89742a6e2d8dd673c

    • SSDEEP

      1572864:QrNItDfUCSp8K0UNl/Ywrt9E7lzPF5KBBhDIVIbjUp1xDV:QeDfUBp8KnAtqBBhDIVNjB

    • Lumma Stealer

      An infostealer written in C++ first seen in August 2022.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Registers COM server for autorun

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v6

Tasks