xdaqvla.zip
- SHA256 1280f1231821c54593cf68cfff6a3d73c9cbf61512df9c4ad17926c6936e43cc
Password
123
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Kernel.dll
Resource
android-x64-20240624-en
android-10-x64
0 signatures
600 seconds
Behavioral task
behavioral2
Sample
Load Driver [ADMIN].bat
Resource
android-x64-20240624-en
android-10-x64
0 signatures
600 seconds
Behavioral task
behavioral3
Sample
Mapper.exe
Resource
android-x64-20240624-en
android-10-x64
0 signatures
600 seconds
Behavioral task
behavioral4
Sample
Valorant.exe
Resource
android-x64-20240624-en
android-10-x64
0 signatures
600 seconds
General
- Target xdaqvla.zip
- Size 202KB
- Sample240630-qjlyfaybpd
- SHA256 1280f1231821c54593cf68cfff6a3d73c9cbf61512df9c4ad17926c6936e43cc
- MD5 7e0aa54618eb85a6c89284fed068a170
- SHA1 627d1d6c1f19aea10a7b612f8e52320f9a2f8794
- SHA512 d6ad1cf4faabdc7d985123a4f856047df041b69069b02c7021c6e614cddc1b7fd7e39a49f4906cc3f6c401e0f060a387d137f3970a1c2bfc45da978f39264516
- SSDEEP 6144:ANXeslhaY8n8XHzUmHP556ZINljOegGGZ+tZpde6E:6XeYHXTUCv6u3lgb+Bu
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Kernel.sys unpack001/Mapper.exe unpack001/Valorant.exe
File Explorer
-
xdaqvla.zip.zip 202KB
-
Kernel.sys.dll 6KB
-
Load Driver [ADMIN].bat38B
-
Mapper.exe.exe 134KB
-
Valorant.exe.exe 247KB
Kernel.sys
- IMPHASH a44ad34e1dd0aef294ba32d4f7e2ba94
- SHA256 73358477c611aae5ba0b1f6f691eab6aaaabddd3b5a52f4ba1ac6ab7e3f0a1f3
- MD5 bccd8eebb6234ff50400d4ac2e76c901
- SHA1 cd7aaf414a4da0719df2206f806e3abaa4dd0e69
- SHA512 1e14f0982a3086d3ea72e70362609affc622f7c8218b198b472cb5cb3103513c8d0206f17a09028e9263152cd15cfd71f51695bb3eb3d91d925a260a1af6321e
- SSDEEP 96:N+ivi0Q8VX5A2+LVSLC+WxljLbHCvEc+KSSy8xP+U7brICi3d:N+iNl+RSMlXmvEc+Pb1j
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
6
Entry point
5760
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Kenei\Desktop\UCMiraka-ValorantExternal-master\x64\Release\Kernel.pdb
ntoskrnl.exe
ExAllocatePool
ZwQuerySystemInformation
DbgPrintEx
ObfDereferenceObject
tolower
MmUnmapIoSpace
IoGetCurrentProcess
PsLookupProcessByProcessId
MmCopyMemory
RtlGetVersion
MmMapIoSpaceEx
ExAllocatePoolWithTag
ExFreePoolWithTag
strcmp
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
1010B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=259, version=26715,
count=3, id=257, version=26715,
count=14, id=1, productName=Unmarked objects,
count=1, id=265, version=31629,
count=1, id=258, version=31629,
Load Driver [ADMIN].bat
- SHA256 419124eb528c4c9ddb1e3713b72be124437f5632cf0ad1cbdc5b81c52407c401
- MD5 b56b9ab3209f7b0958976644f03776f8
- SHA1 054c58ab6b517710776fa6ed8e20aabaf37d360f
- SHA512 bf2515e032f3dd8885b4e8aead91dce3d46199d3dad242b8fee980b33a99def11def0f64936da7f3d456d4d376f0c3df68a4dca04b50f9cd314e99441a3d9f77
- MD5 SHA1 SHA512
Mapper.exe
- IMPHASH afc1f930b16856804326528e39e42dd5
- SHA256 6ebcc6896b243c761da4fc28a26249b0c146ae17aff7697c09bc447008e831df
- MD5 34cfbe3ff70461820ccc31a1afeec0b3
- SHA1 5d32e91c039c9a6f723ba3c04c1179d02e6a0ce9
- SHA512 1ca4661be645e7e954d89c83f1fd126a5e936533052d4e330c9faccb83bb5942d28265375cee743e468b1625a0c1f10888e7957fe88c718e8501a86a78cdc06e
- SSDEEP 3072:rOUDtpXnRNEvhxNyatnKl9rGmJTQSaMm5/6TYfEBjgQ:rOUDDXnRNEv7wEo9WlTfYjg
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
6
Entry point
63036
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\XD\kdmapper-master\kdmapper-master\x64\Release\kdmapper.pdb
kernel32
GetCurrentThreadId
GetModuleHandleA
GetLastError
CloseHandle
CreateFileW
GetProcAddress
DeleteCriticalSection
GetCurrentProcessId
SetUnhandledExceptionFilter
GetTempPathW
FormatMessageA
InitializeCriticalSectionEx
VirtualAlloc
DeviceIoControl
VirtualFree
GetFileAttributesExW
AreFileApisANSI
GetFileInformationByHandleEx
WideCharToMultiByte
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
LocalFree
advapi32
RegCloseKey
RegDeleteKeyW
RegCreateKeyW
RegOpenKeyW
RegSetKeyValueW
msvcp140
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@PEBX@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$ctype@_W@std@@QEBA_WD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@J@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?id@?$ctype@_W@std@@2V0locale@2@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Xlength_error@std@@YAXPEBD@Z
ntdll
NtQuerySystemInformation
RtlInitUnicodeString
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception
__C_specific_handler
memset
_CxxThrowException
__std_terminate
__std_exception_destroy
memcpy
memcmp
__current_exception_context
memmove
__std_exception_copy
api-ms-win-crt-stdio-l1-1-0
_fseeki64
fread
fsetpos
ungetc
fputc
fflush
_set_fmode
setvbuf
fgetpos
fwrite
__p__commode
_get_stream_buffer_pointers
fgetc
fclose
api-ms-win-crt-heap-l1-1-0
malloc
_set_new_mode
_callnewh
free
api-ms-win-crt-utility-l1-1-0
rand
srand
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_wremove
_unlock_file
api-ms-win-crt-string-l1-1-0
_wcsicmp
_stricmp
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-runtime-l1-1-0
_initterm_e
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_initterm
__p___wargv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_c_exit
exit
_register_thread_local_exe_atexit_callback
terminate
_invalid_parameter_noinfo_noreturn
_exit
__p___argc
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
62KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
65KB
Virtual Size
65KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=10, id=260, version=30034,
count=4, id=259, version=30034,
count=33, id=261, version=30034,
count=6, id=257, version=30034,
count=9, id=257, version=27412,
count=244, id=1, productName=Unmarked objects,
count=6, id=265, version=30145,
count=1, id=255, version=30145,
count=1, id=258, version=30145,
Valorant.exe
- IMPHASH 4783753ff7d43e7e3556102b6b69404d
- SHA256 dcbcf99bf143cb21d2a828362f64e4519d2d5f7e7411483f04e998aea896e2e7
- MD5 0d38e569ba9f0795dccbffd5b6749ad5
- SHA1 e3ca20111e19cb41582da238052bfe57c4304c4b
- SHA512 d4c3ff627e77ee594a68215962a22ae440300165411a610ff19bbe08bca89f533e5a0df4c1ae94ec4d9b889cc6d77f014eb40531d27fc32c505010af9b329f14
- SSDEEP 6144:KCgKDEZTMxMQbAjrV8xUPvIC0fQ4nWUfkry8:KCQBkAjre6nTF4nWU8
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
6
Entry point
195568
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\MellowNight\Desktop\Valorant\x64\Release\Valorant.pdb
kernel32
FreeLibrary
QueryPerformanceCounter
SetLastError
CreateToolhelp32Snapshot
Sleep
GetLastError
Process32NextW
Process32FirstW
CloseHandle
CreateThread
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
QueryPerformanceFrequency
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetProcAddress
LoadLibraryA
GlobalUnlock
WideCharToMultiByte
GlobalFree
GlobalLock
GlobalAlloc
MultiByteToWideChar
user32
GetWindowLongW
SetLayeredWindowAttributes
TranslateMessage
LoadIconW
SetWindowLongW
GetDesktopWindow
RegisterClassExA
GetWindowThreadProcessId
GetKeyState
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
ScreenToClient
CreateWindowExA
GetWindowRect
DestroyWindow
SetWindowPos
GetSystemMetrics
ShowWindow
GetAsyncKeyState
DefWindowProcA
DispatchMessageW
PeekMessageW
MoveWindow
EnumWindows
UpdateWindow
ClientToScreen
OpenClipboard
GetCursorPos
SetCursorPos
GetClientRect
SetCursor
LoadCursorW
GetForegroundWindow
GetWindow
imm32
ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmAssociateContextEx
dwmapi
DwmExtendFrameIntoClientArea
msvcp140
_Thrd_detach
_Cnd_do_broadcast_at_thread_exit
?_Xlength_error@std@@YAXPEBD@Z
?_Throw_C_error@std@@YAXH@Z
?_Throw_Cpp_error@std@@YAXH@Z
d3d9
Direct3DCreate9Ex
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memset
__C_specific_handler
__current_exception_context
__current_exception
__std_exception_copy
__std_exception_destroy
_CxxThrowException
strstr
__std_terminate
memchr
memcmp
memcpy
memmove
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
_wfopen
fwrite
_set_fmode
__p__commode
__stdio_common_vfprintf
fseek
fclose
fflush
__acrt_iob_func
__stdio_common_vsscanf
ftell
fread
__stdio_common_vsprintf_s
api-ms-win-crt-string-l1-1-0
strcmp
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-heap-l1-1-0
free
malloc
_set_new_mode
_callnewh
api-ms-win-crt-runtime-l1-1-0
_configure_narrow_argv
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
_cexit
__p___argc
__p___argv
_c_exit
_set_app_type
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_invalid_parameter_noinfo_noreturn
terminate
exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_initialize_narrow_environment
_beginthreadex
api-ms-win-crt-math-l1-1-0
cosf
sinf
ceilf
acosf
sqrtf
__setusermatherr
tanf
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
190KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
44KB
Virtual Size
43KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
184B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=6, id=257, version=30034,
count=27, id=261, version=30034,
count=9, id=260, version=30034,
count=3, id=259, version=30034,
count=11, id=257, version=27412,
count=183, id=1, productName=Unmarked objects,
count=8, id=265, version=30145,
count=1, id=255, version=30145,
count=1, id=258, version=30145,