Overview

overview

10

Static

static

10

ValoaimV8.exe

windows11-21h2-x64

10

ValoaimV8.exe

ubuntu-18.04-amd64

ValoaimV8.exe

debian-9-armhf

ValoaimV8.exe

debian-9-mips

ValoaimV8.exe

debian-9-mipsel

XInput1_4.dll

windows11-21h2-x64

1

mfcm140u.dll

windows11-21h2-x64

1

mfcm140u.dll

ubuntu-18.04-amd64

mfcm140u.dll

debian-9-armhf

mfcm140u.dll

debian-9-mips

mfcm140u.dll

debian-9-mipsel

rasadhlp.dll

windows11-21h2-x64

1

umpdc.dll

windows11-21h2-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    ValoaimV8.rar
  • Size 7.0MB
  • Sample240420-se6s6abb57
  • SHA256 193d9acadf1f7cb18bd295f774c644f34da72dbc10c2eccd39c858f55f320a2f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
blankgrabberquasarvalorantlinuxspywarestealertrojanupx

Malware Config

Extracted

Family

  • quasar

Version

  • 1.3.0.0

Botnet

  • Valorant

C2

  • hanekese.ddns.net:1005

Mutex

  • QSR_MUTEX_vjIusnIFPVRxcR2xS4

Attributes
  • encryption_key

    5V49FWeqLdk5NQWJl6h7

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    mac updater

  • subdirectory

    SubDir

Targets

    • Target
      ValoaimV8.exe
    • Size 20.0MB
    • SHA256 443be4b5119ad344755137062321a4f5c249e8fb95482183c21378ba93fd96bf
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    quasarvalorantspywarestealertrojanupx

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2behavioral3behavioral4behavioral5
    • Target
      XInput1_4.dll
    • Size 44KB
    • SHA256 cc119f987bf33731fcd22c3a9bbcc675f31d80593a4c26428b363d6eedef974b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral6
    • Target
      mfcm140u.dll
    • Size 94KB
    • SHA256 71dd9c15438bc082c56d320cbcb34a7cef366884a95fcbb18b9f6b6dd2b0291f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral10behavioral11behavioral7behavioral8behavioral9
    • Target
      rasadhlp.dll
    • Size 17KB
    • SHA256 81a4eecae1d6be831a6a720fdab12095cc5ce009798b551de802252a44dad425
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral12
    • Target
      umpdc.dll
    • Size 64KB
    • SHA256 52149a7fee76e2022a8b71467b512073c0ac3b10ac763f232adfb38f69ae057c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral13

MITRE ATT&CK Enterprise v15

Tasks