General

  • Target

    Perm_Spoofer_Valorant.exe

  • Size

    8.2MB

  • Sample

    241115-stjl6swgkq

  • MD5

    f5f78b9fca384395582f5b7464c3b446

  • SHA1

    27eebd77ce0447bf7109bbd80a05c00de1e60574

  • SHA256

    03d092f864d8e4b082ed8268f6c46efa8ec7358e0ab4aa6e42712c925de91078

  • SHA512

    8ae23898da8485ae0f5f7c69035f4356fb340a4046d76a7974e85c632ee242ec817adb4079a09df9675e8bb3c9ecad092910209d00557791f01279bb414ccd35

  • SSDEEP

    196608:KIWhOwsurErvI9pWjg/Qc+4o673pNrabebSEdyzWtPMYnNcss:o8urEUWjZZ4dDLIeW7zWtPTNzs

Malware Config

Targets

    • Target

      Perm_Spoofer_Valorant.exe

    • Size

      8.2MB

    • MD5

      f5f78b9fca384395582f5b7464c3b446

    • SHA1

      27eebd77ce0447bf7109bbd80a05c00de1e60574

    • SHA256

      03d092f864d8e4b082ed8268f6c46efa8ec7358e0ab4aa6e42712c925de91078

    • SHA512

      8ae23898da8485ae0f5f7c69035f4356fb340a4046d76a7974e85c632ee242ec817adb4079a09df9675e8bb3c9ecad092910209d00557791f01279bb414ccd35

    • SSDEEP

      196608:KIWhOwsurErvI9pWjg/Qc+4o673pNrabebSEdyzWtPMYnNcss:o8urEUWjZZ4dDLIeW7zWtPTNzs

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    • Drops file in Drivers directory

    • Clipboard Data

      Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

    • Accesses cryptocurrency files/wallets, possible credential harvesting

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

    • Enumerates processes with tasklist

    • Hide Artifacts: Hidden Files and Directories

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks