Install VALORANT[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Install VALORANT.exe
Size 71.3MB
Sample260620-3cf5tsas9m
SHA256 ce56cdb2b0a7d27be939e201fd6f814f70b881b5f4f58dfcb1ed5f9ff0b5a86a
MD5 16e09158a22085340569d473b04846bc
SHA1 c85127f1dc04cc7e7d87cceeb6b734c67a996c79
SHA512 134b13400480ececc77d7e6881bd9d172f092ad39d797ab5e14556d65a5d02175fa742a91a107b21e24d3e29d1b216e7ec1b75f89c118c34812b437fdc5543fa
SSDEEP 1572864:hqX2BSp8d0UNl/Ywrt9E7lzPFUKBBJDIVIbjSp1xet:grp8dnAthBBJDIVRjU
TLSH
T17CF7121EB96800EDC8BFD17896DA5917EA7138560320B6DB32E0DD612F53AF85E3D312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Install VALORANT.exe

.exe 71.3MB

Install VALORANT.exe

IMPHASH c8620c9d9740973791e86edd73e8f612
SHA256 ce56cdb2b0a7d27be939e201fd6f814f70b881b5f4f58dfcb1ed5f9ff0b5a86a
MD5 16e09158a22085340569d473b04846bc
SHA1 c85127f1dc04cc7e7d87cceeb6b734c67a996c79
SHA512 134b13400480ececc77d7e6881bd9d172f092ad39d797ab5e14556d65a5d02175fa742a91a107b21e24d3e29d1b216e7ec1b75f89c118c34812b437fdc5543fa
SSDEEP 1572864:hqX2BSp8d0UNl/Ywrt9E7lzPFUKBBJDIVIbjSp1xet:grp8dnAthBBJDIVRjU
TLSH
T17CF7121EB96800EDC8BFD17896DA5917EA7138560320B6DB32E0DD612F53AF85E3D312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

d9:72:d2:f8:9a:8c:5d:a2:c8:89:a3:2f:57:58:2d:a2:e4:67:a7:6c:89:14:9c:dc:5d:ec:cd:9d:73:ec:95:f3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=4155843,CN=Riot Games\, Inc.,O=Riot Games\, Inc.,L=Los Angeles,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 5, 2026

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

01:53:97:f6:21:77:85:ed:12:69:f9:4e:77:b5:87:74

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 30, 2024 - Dec 4, 2026

Minor OS version

Major OS version

Entry point

8824844

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

T:\tmp\Products\Launcher\X64-Public\bin\RiotClientServices.pdb

advapi32

CreateWellKnownSid RegCloseKey RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegGetValueW SetEntriesInAclW GetNamedSecurityInfoW SetNamedSecurityInfoW SetSecurityInfo BuildTrusteeWithSidW ConvertStringSecurityDescriptorToSecurityDescriptorW OpenProcessToken AllocateAndInitializeSid CheckTokenMembership FreeSid GetFileSecurityW GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation ConvertSidToStringSidA ConvertSecurityDescriptorToStringSecurityDescriptorA RegDeleteKeyW RegDeleteValueA RegEnumKeyExW RegQueryInfoKeyW RegQueryValueExW GetEffectiveRightsFromAclW ConvertStringSidToSidW RegDeleteKeyExW AdjustTokenPrivileges LookupPrivilegeValueW SystemFunction036

bcrypt

BCryptGenRandom

crypt32

CertFreeCertificateContext CertOpenStore CertCloseStore CertEnumCertificatesInStore

dnsapi

DnsFree DnsQuery_W

gdi32

GetTextExtentPoint32W GetDIBits CreateFontW CreateDIBitmap ExtTextOutW AddFontMemResourceEx RemoveFontMemResourceEx SetBkMode GetTextExtentExPointW CreateCompatibleDC DeleteDC DeleteObject SelectObject SetTextColor CreateDIBSection GetObjectW

gdiplus

GdipFree GdipAlloc GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipCreateBitmapFromStream GdipBitmapLockBits GdipBitmapUnlockBits

kernel32

GetNativeSystemInfo WriteConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP FreeLibraryWhenCallbackReturns GetLogicalDriveStringsW QueryDosDeviceW IsDebuggerPresent DebugBreak OutputDebugStringW GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap GetCurrentProcess GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress LocalFree FormatMessageW K32GetMappedFileNameW OutputDebugStringA CloseHandle WaitForSingleObject WaitForSingleObjectEx TerminateProcess GetExitCodeProcess CreateThread CreateProcessW GetProcessId OpenProcess VirtualAlloc VirtualFree IsProcessInJob CreateJobObjectW AssignProcessToJobObject TerminateJobObject SetInformationJobObject ReadFile SetEvent CreateEventW GetModuleHandleA GlobalAlloc GlobalLock MultiByteToWideChar CreateFileW FindClose FindFirstFileA FindFirstFileExA FindNextFileA FlushFileBuffers GetFileAttributesExA GetFileSizeEx LockFileEx SetFilePointer SetFilePointerEx UnlockFileEx WriteFile GetTempPathW RaiseException GetProcessTimes GetCurrentProcessId GetCurrentThread GetModuleFileNameW K32GetModuleFileNameExW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentDirectoryW CreateDirectoryW DeleteFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW GetFinalPathNameByHandleW GetTempFileNameW RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFileInformationByHandle DeviceIoControl Sleep GetSystemInfo GetSystemTime GetVersionExW GetPhysicallyInstalledSystemMemory FreeLibrary LoadLibraryW MoveFileExW SystemTimeToFileTime GetFileInformationByHandleEx GetLogicalProcessorInformation VerSetConditionMask GetCommandLineW GetCurrentDirectoryA DeleteFileA GetDiskFreeSpaceA GetFileAttributesA QueryPerformanceCounter QueryPerformanceFrequency GetLocalTime CopyFileW VerifyVersionInfoW WideCharToMultiByte LocalAlloc LoadResource LockResource SizeofResource EnumResourceNamesA QueryFullProcessImageNameW FindResourceA GetUserDefaultLCID InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable CreateThreadpoolWork SubmitThreadpoolWork WaitForThreadpoolWorkCallbacks CloseThreadpoolWork SwitchToThread GetExitCodeThread GetLogicalProcessorInformationEx SleepConditionVariableSRW RtlVirtualUnwind ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockExclusive InitOnceExecuteOnce GetTickCount MapViewOfFile CreateFileMappingW GetSystemTimeAsFileTime GetFileSize UnlockFile HeapDestroy HeapCompact HeapReAlloc HeapSize HeapValidate UnmapViewOfFile CreateMutexW LockFile GetDiskFreeSpaceW GetFullPathNameW HeapCreate AreFileApisANSI TryEnterCriticalSection FormatMessageA GetLocaleInfoEx LCMapStringEx CompareStringEx GetCPInfo EncodePointer DecodePointer InitializeCriticalSectionEx IsProcessorFeaturePresent GetEnvironmentVariableA SleepEx GetSystemDirectoryW GetStdHandle GetDiskFreeSpaceExW GetFileInformationByHandle SetFileTime CreateSymbolicLinkW GetCurrentProcessorNumber VirtualQuery GetLargePageMinimum GetNumaHighestNodeNumber GetNumaNodeProcessorMask WriteConsoleA GetConsoleScreenBufferInfo InitOnceBeginInitialize InitOnceComplete GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LoadLibraryExW GetConsoleOutputCP GetConsoleMode GetStringTypeW TlsAlloc TlsGetValue TlsSetValue SetUnhandledExceptionFilter GetTimeZoneInformation InitializeCriticalSectionAndSpinCount TlsFree IsValidCodePage EnumSystemLocalesW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW ExitProcess SetEnvironmentVariableW SetStdHandle ReadConsoleW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW FreeLibraryAndExitThread ExitThread RtlUnwind RtlUnwindEx RtlPcToFileHeader InitializeSListHead GetStartupInfoW UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext SetHandleInformation

ole32

CoInitialize CoInitializeEx CreateStreamOnHGlobal CoUninitialize CoCreateInstance

rpcrt4

UuidCreate

rstrtmgr

RmGetList RmStartSession RmEndSession RmRegisterResources

shell32

CommandLineToArgvW ShellExecuteW SHGetFolderPathW SHGetMalloc SHGetPathFromIDListW SHBrowseForFolderW ShellExecuteExW

user32

SetWindowLongPtrW LoadCursorW MonitorFromWindow GetMonitorInfoW SendMessageW SetWindowPos GetWindowLongPtrW UnregisterClassW RegisterClassExW CreateWindowExW ShowWindow GetWindowPlacement GetKeyState SetActiveWindow SetWindowTextW SetCursor ScreenToClient GetWindowLongW ReleaseDC GetDC SetForegroundWindow ReleaseCapture SetCapture UpdateLayeredWindow DestroyWindow DefWindowProcW PeekMessageW DispatchMessageW TranslateMessage PostQuitMessage GetMessageW

ws2_32

getaddrinfo freeaddrinfo WSASetLastError WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAIoctl WSAResetEvent WSASetEvent WSAWaitForMultipleEvents ioctlsocket connect accept __WSAFDIsSet socket getsockname closesocket bind ntohs inet_addr WSACleanup WSAStartup htons htonl WSAGetLastError shutdown getsockopt send select recv ntohl listen inet_pton setsockopt

oleaut32

SysAllocString GetErrorInfo SetErrorInfo SysFreeString SysStringLen

Name

.text

Size

8.9MB

Virtual Size

8.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

105KB

Virtual Size

329KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

416KB

Virtual Size

416KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

CPADinfo

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

59.8MB

Virtual Size

59.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

43KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Install VALORANT.exe

advapi32

bcrypt

crypt32

dnsapi

gdi32

gdiplus

kernel32

ole32

rpcrt4

rstrtmgr

shell32

user32

ws2_32

oleaut32

generic