valorantvgcq[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
valorantvgcq.exe
Size 1.6MB
Sample260710-axq7bacw21
SHA256 d048e5dac736bb4c9b4c29f06c216c8798b2b8e576100912b83f07bd9da8aeb3
MD5 544a4055b26f4fe54a41a7b6ecaf48fd
SHA1 efb0e0a499f2399c0349cf87d8c2f2c0fe41d79e
SHA512 1dbec0b9a9374187a279d9d484949c75924a3f8524ab3789d7d88f93af315e637c80578f987dcece804beda58785875e2f9e28e9e41b1c8312d99075efcffe0e
SSDEEP 24576:mmv3ujNvpDkRuuTI2a61FxnYDywDqlOB/am6+bZ7RLhHB:ms4vDkRf+ywlamr9r
TLSH
T1EE757C07E3E5CAEAC89EE274528B2718E770FC5117916ADB936052502F577E89E3FB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
valorantvgcq.exe

File Explorer

valorantvgcq.exe

.exe 1.6MB

valorantvgcq.exe

IMPHASH 731d438b89674751f7c4aee848e0df0b
SHA256 d048e5dac736bb4c9b4c29f06c216c8798b2b8e576100912b83f07bd9da8aeb3
MD5 544a4055b26f4fe54a41a7b6ecaf48fd
SHA1 efb0e0a499f2399c0349cf87d8c2f2c0fe41d79e
SHA512 1dbec0b9a9374187a279d9d484949c75924a3f8524ab3789d7d88f93af315e637c80578f987dcece804beda58785875e2f9e28e9e41b1c8312d99075efcffe0e
SSDEEP 24576:mmv3ujNvpDkRuuTI2a61FxnYDywDqlOB/am6+bZ7RLhHB:ms4vDkRf+ywlamr9r
TLSH
T1EE757C07E3E5CAEAC89EE274528B2718E770FC5117916ADB936052502F577E89E3FB00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1343488

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptEncrypt BCryptGenerateSymmetricKey BCryptGetProperty BCryptOpenAlgorithmProvider BCryptSetProperty

crypt32

CryptBinaryToStringA CryptStringToBinaryA

api-ms-win-crt-private-l1-1-0

__C_specific_handler memchr memcmp memcpy memmove

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf_s _close _fileno _fseeki64 _ftelli64 _get_osfhandle _setmode _wfopen _wopen fclose fflush fgetwc fopen fputc fputwc fread fseek fwrite getc setbuf setvbuf ungetc ungetwc

api-ms-win-crt-string-l1-1-0

_iswalpha_l _iswcntrl_l _iswdigit_l _iswlower_l _iswprint_l _iswpunct_l _iswspace_l _iswupper_l _iswxdigit_l _strcoll_l _strdup _strxfrm_l _tolower_l _toupper_l _towlower_l _towupper_l _wcscoll_l _wcsicmp _wcsxfrm_l isdigit isspace isxdigit mbrlen memset strcmp strlen strncmp strnlen tolower toupper wcscmp wcscpy wcslen wcsncmp wcsnlen

api-ms-win-crt-runtime-l1-1-0

_assert __p___argc __p___argv __sys_nerr _beginthreadex _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal strerror strerror_s system

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func __pctype_func _configthreadlocale _create_locale _free_locale localeconv setlocale

api-ms-win-crt-time-l1-1-0

_localtime64_s _strftime_l

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

advapi32

CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGenRandom CryptGetHashParam CryptHashData CryptReleaseContext

kernel32

AcquireSRWLockExclusive AreFileApisANSI Beep CloseHandle ConnectNamedPipe CreateDirectoryW CreateFileW CreateHardLinkW CreateNamedPipeW CreateSymbolicLinkW CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DeleteFileW DeviceIoControl EnterCriticalSection FindClose FindFirstFileW FindNextFileW FlsAlloc FlsGetValue FlsSetValue FormatMessageA GetActiveProcessorCount GetCurrentDirectoryW GetCurrentThreadId GetDiskFreeSpaceExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetLastError GetModuleFileNameA GetModuleHandleW GetProcAddress GetProcessHeap GetSystemTimeAsFileTime GetTempPathW GetThreadId HeapAlloc HeapFree InitOnceExecuteOnce InitializeCriticalSection LeaveCriticalSection LocalFree MoveFileExW MultiByteToWideChar Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetConsoleTitleW SetCurrentDirectoryW SetEndOfFile SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread TlsGetValue TryAcquireSRWLockExclusive TryEnterCriticalSection VirtualProtect VirtualQuery WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile

api-ms-win-crt-multibyte-l1-1-0

_mbtowc_l

api-ms-win-crt-convert-l1-1-0

_strtod_l mbrtowc mbsrtowcs strtof strtol strtoll strtoul strtoull wcrtomb wcrtomb_s wcstod wcstol wcstoll wcstoul wcstoull

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

Name

.text

Size

712KB

Virtual Size

711KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

185KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/58

Size

79KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

61KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/82

Size

131KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/33

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/47

Size

41KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rcd7cb

Size

88KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

valorantvgcq.exe

winhttp

bcrypt

crypt32

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

advapi32

kernel32

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic