General
-
Target
Perm_Spoofer_Valorant.exe
-
Size
8.2MB
-
Sample
241115-stjl6swgkq
-
MD5
f5f78b9fca384395582f5b7464c3b446
-
SHA1
27eebd77ce0447bf7109bbd80a05c00de1e60574
-
SHA256
03d092f864d8e4b082ed8268f6c46efa8ec7358e0ab4aa6e42712c925de91078
-
SHA512
8ae23898da8485ae0f5f7c69035f4356fb340a4046d76a7974e85c632ee242ec817adb4079a09df9675e8bb3c9ecad092910209d00557791f01279bb414ccd35
-
SSDEEP
196608:KIWhOwsurErvI9pWjg/Qc+4o673pNrabebSEdyzWtPMYnNcss:o8urEUWjZZ4dDLIeW7zWtPTNzs
Behavioral task
behavioral1
Sample
Perm_Spoofer_Valorant.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Perm_Spoofer_Valorant.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
Perm_Spoofer_Valorant.exe
-
Size
8.2MB
-
MD5
f5f78b9fca384395582f5b7464c3b446
-
SHA1
27eebd77ce0447bf7109bbd80a05c00de1e60574
-
SHA256
03d092f864d8e4b082ed8268f6c46efa8ec7358e0ab4aa6e42712c925de91078
-
SHA512
8ae23898da8485ae0f5f7c69035f4356fb340a4046d76a7974e85c632ee242ec817adb4079a09df9675e8bb3c9ecad092910209d00557791f01279bb414ccd35
-
SSDEEP
196608:KIWhOwsurErvI9pWjg/Qc+4o673pNrabebSEdyzWtPMYnNcss:o8urEUWjZZ4dDLIeW7zWtPTNzs
-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Drops file in Drivers directory
-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Unsecured Credentials: Credentials In Files
Steal credentials from unsecured files.
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Obfuscated Files or Information: Command Obfuscation
Adversaries may obfuscate content during command execution to impede detection.
-
Enumerates processes with tasklist
-
Hide Artifacts: Hidden Files and Directories
-
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Obfuscated Files or Information
1Command Obfuscation
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3