�m�ݩ���n��sk���(���붅$���[��Ci`\�|-̯}���f&!eM���a�l��F��g#� N�H���P�n���� ͉�ݴ�g��RB6��}��8�����}2h�� ��� �z���c9�Z�P��hUJ�7kT��m����R]��j�Ϙ�K�:F��?ic3ju �~Ģ9d�x�[�{5��c��EC�t�k/�}mo���yꝏ ��*s�_���qk�B ���[_�H}Z�(��F/� B�a��&Z���`c��}�H�CJR��R���ki�O�+i���`�qF.�z���ƸµD�E�U]#l���|�-Hxw�N"Eﬦ ��ZD�8{(�/��T�Ӫx�ЮW|R"i����,����ˠr��\�m�Z'KB�\���8��HN���B��S���5�E���(W#n��#��x�jT�p��GP%En��~scO�8 Ev+�� �o�%\��N\;e�ek���c��tu�&�(�@&���6�a�|G��Q,�gr@W��.`�Rx� �u<p٩#���-��?l��Y{cM�F�D��� �E-\���&4������ 3xW^g�����ڮԽ_���[�m��=�f�� <�Y$��%���θn������֍�)ţQ����a�l{"�D�ߊbRl��H$8�ߔ[DJ�AfL�>g�N�*�CAn�*@�bLDo�]��>�����S�u$�{�R�n��$��W+G���r�a�P[��ԫ+���wE��W~nZU�,��XE6k�����B���ӄG%c�;��H\�^�+V�'�����M�� YC�������A� 2��Y�+zfx{/ �@(oW�\�N9l�̐QЊ�$?П�0�/��V��/�������P lgm���(���]���kYt�=ÞHO��G),�]z�������Ck�7��S���*��ې�����CJ��k+�.g|z����=�թX��Z���L��VC��}���×gx�^���M�l�����XKo�h�9�v�Ls��V��*PR�EM����������˖P=E9 ���)�_��}Iě]��z4s����j�:�P��e�%����k��3�� AA@>1�"~�Zެ��{8o���^�����/������u�01����R�>��e�f�Hda�����:�ꣾ�a�B�E�h��z�3�I9�n�|O�q�6����/�z�,�L��q�B�(�&5S�5�4��V���]]��I��|�I"�E���#S��4�N���+��F�b?���t��.)~�Ҍ��y]����F8�j��鐡������LNRQ��\n�ٶ��vs���͜�g�s����mMz���W�9���[]�L��� �����X�ye����;�4ӯ< �'L����hY�%��W�L�J�0�i4���~{S:ϴP5�Q���:>J�ל{u�]NM S`�1�����{{N��Ƚ�w���W�%oM�b'��"�������*?����6Ǵ�?��*%��.z=Y���b4��r�<��ѓ� zH�,�C�3 Pz}5?t_�^��Gm��9g�+YZ"�I`1\'��tj����?o���rda� Y��[����R�t ��M��QE��YHswT�Y�FR�AG)Tj��&,�2�k�Ub�f�#�E��Aw�~��z��96�)�~��n�r^v]���N����x,��,�oJ������������b�rɹ�U��d��@ͺ�c^���:m��X;�-Mn�O�����T�7�� 2���D�-r7�+&�,I�(<HY�H*�:S�:�լ���3�e����D"(���6�CE�2j�MDf�7ws� ��k���}��lqLr�[́ ����g�D'��X|D�*b���ب���p�7��K���1mf��VFA�R鍲��!W�"���tKpl��bC�tͿ`~�'�4߫�?x�`A����h��U���5����� bK�X��i sPS��Λ�Q��$5eA�S}�r����o��&�k��q��:Av�Q������F'��3g��!U��-8�k49T% V@�U7Za�չ���l���t7�k;,��Fp���M��d�He(N���� �#�1�� ���:�'�E 4���6���<b4}����U��+�M����|5vh�Q�g3]�_|���Y�uG�8���2���uM���^���s#��E�A� ��K������jKɼW8��6DZ��j)X���e��y�ݱv:���eCS���7�]�<L���zU��'_�wf0�JD���C)[���]����I�����a;�}WxFP�Π%潍ߥN��]%�i���TX/������1v�o�t�ڡ (������mͫ��}��#���R���c��'x��t�GH�ٶ����əȪ �ѷ�pѪ�-�.X�Ì��P�<�;� ��8�h�u�Cy� �����#��">Ba����_,�oh���V�SL�.��n�bGE=O�4����fw�4jX�ïAH��W�}�)�eD�Q�O+�P�_����������Βv�����f��?&uvi��j���#�3zS;p��v7��U�@�8���d����gҋ� �l��z �e��ǩ���!^�ʫ$�LYy����<���ό�{�فq�es����ԈvM]P<Y�Ѽ���7�\ 3�ylb���Tab��3M7¢1��2 !(���NU�*�Q����KԈ����d�e��z^f ��������o86��^�����+�ƴ��6�@�����ҩ��_���-O6;I1ɮ�X �ˣ2�G�pl�ct ��DJT�{93�ڒ��9�W�����T�V������?�������#MK��4�%���w]�Q?.�2�ϭ�p ��RuY�Ka��$��&R�rf������a?Z�D�u�Z�v�G8�|����w� �d��' J�8x��*�v��M��nҙJ3&�����)\�gQ�S$\����D�k �\:z�σul}��>@��I+����d��L�Q�\p��q�N�Bm�^���l�$~�s������~�w=>�a��J��hzhi�>�zD�Rw�L�4��w�ª��μ>F��A
Behavioral task
behavioral1
Sample
Yonder_Valorant.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Yonder_Valorant.exe
Resource
win10v2004-20240508-en
General
-
Target
Yonder_Valorant.exe
-
Size
6.9MB
-
MD5
affe1cb6c83de7c4ce9af5d85653a7b3
-
SHA1
9a472377f6e496afac65eb141b8efc751e41370f
-
SHA256
a53becf8e0d3cb436581b171abbb26def07407243dac1700cb37b37de580ce4d
-
SHA512
8b436ecdb1a75bbe5ee17f9aa4faa127c63a01c0bc93a0bfa4735e88468e7ffe439553b120a6f81ef40bfb97dd36ebacdb185890a26628c132cd1ec6ca974717
-
SSDEEP
98304:U71K1YcPS8iY0e1PiUeF9qa0CJv5z7+wmgvEAMSnLIUBt0KgEFP+uY+BIRWyIqS:UsOcK82ecBTz+QvayIEkuLwS
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Yonder_Valorant.exe
Files
-
Yonder_Valorant.exe.exe windows:6 windows x64 arch:x64
81a282a7674ad3d2396baf9b6fd4604b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
OutputDebugStringW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CloseClipboard
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
gdi32
BitBlt
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?setf@ios_base@std@@QEAAHHH@Z
shlwapi
PathFindFileNameW
imm32
ImmReleaseContext
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
normaliz
IdnToAscii
wldap32
ord26
crypt32
PFXImportCertStore
ws2_32
setsockopt
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
__sys_nerr
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-math-l1-1-0
cosf
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
localeconv
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 722KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 932KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.9MB - Virtual size: 6.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 204B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ