Extracted

Extracted

• • Target
    valorant-free-version.zip
  • Size 121KB
  • SHA256 fe96158ec09328a2f1d96449d6bbaff904139d1733f94b8167b086c07f178208
  • MD5 e23ee434126e197cca4b1db7bdf84ddc
  • SHA1 cfa7bc273ca2c5cfc12a8f7a92adcd207f1e81c3
  • SHA512 18b7198171f3baad6906d7608f59573d699a79fea3f3f49b57e96d0ed3a6ff80ef80aff7d06a76d67afcfd4cf39c9a066f17c406db010a46fc1b21e1b24d5fa5
  • SSDEEP 3072:EDQTaSztzfbUb14bnJpJ0R13t2MyrWJrkNEp2rut:dTPnUR4LvJW3t2ILUSt
  • TLSH
    T11AC312C0E716ECDBF676EC70E1D681E806FF523E194AB06C8540971D3A8AA663381C79
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    valorant-free-version/01-README.txt
  • Size 74B
  • SHA256 5cc618d256c2051137e4e2cae2cee8e6ee9fffeadc7fb5a08cf9d78125d00041
  • MD5 7614d0d4ed368462d3baaaeef41fe24c
  • SHA1 f4b7bc2b603c017dd93465a58a3b8997c0741635
  • SHA512 f8e5f1298dc88036d2a768d14174122840ed0b2e54653dd06e0fd4447acd93f5f54e05dccb95c82b82af5ca6030100067ba6e59ca8361a73baf25830f7194b6e
  • TLSH
    T1A7A022BE3800A2028000BC8EEA2B238AC32AC83B0A00C000382033C8322CC0B80BC0CB
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    valorant-free-version/STARTUP.bat
  • Size 100B
  • SHA256 077811bf6899e0b529dedbf546396264027603240ab84dc9568d4522d859904c
  • MD5 927840fe3b829d44a0726912f7861662
  • SHA1 35b42afe2e28d097ae4a16101d749839650a4f07
  • SHA512 64cc4f4bcb135dcd630a6ae4d452e0a08303fc5d37cf465b58da1351201a18e9b6a1ea6eb8bacf9e9eb53f452da761774722e435ea113ad3ff363cc7fd190c63
  • TLSH
    T161B012025C0B48648CB11E4024D67342D107008D412CA68FD0D2041054AFEE06784E04
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  discoveryexecutiondiscordratumbralpersistenceratrootkitstealer

  • Detects Umbral payload

  • Family: Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral5behavioral6
• • Target
    valorant-free-version/message.vbs
  • Size 519B
  • SHA256 3fac92eda940e65c577ec1b71343a7ef2191fa63484930da9254011d572dae3d
  • MD5 42325b614eb998ccfc2117dd8c95230a
  • SHA1 d8e089b0bf2d2c165e90c97ece45cbee0f5074f3
  • SHA512 b3c88ea302d7028438f47a854a15a2ed6156cbd9a2712a36c0eb9e429258a3d5e16d2b2dcad234314f0294aaaf4f9c8bc49f26d385bcd3dc6813084e53b38452
  • TLSH
    T198F0208ADF0FEF201D033791034D0415AB1EF200806D04BD3F9C440E93B8308614F689
  • MD5 SHA1 SHA512 TLSH

  Score

  7^/10

  execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral7behavioral8
• • Target
    valorant-free-version/resources/sc.bat
  • Size 67B
  • SHA256 1f81bf42a026a147d2dedf20b8d36168acca2d6b6a8ce75769446c7a63997044
  • MD5 289328cabf5fce44e2a221ddaedec1d6
  • SHA1 7bdffb3beef8ea00c6dff4c8d971bb62ff682651
  • SHA512 f06d2164187672165cbace03db26bfc5930a66fcec44a1059c7c55135f0c46df6da45cd561ed513650a9fdc6fe43372173a56b9df90c184344ba8499ff8e4268
  • TLSH
    T116A002218C77850059511D86D9DB3397B80B40CE14AA8BE492C11559C85BDCA6A0991B
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  discoveryexecutionumbralstealer

  • Detects Umbral payload

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral10behavioral9
• • Target
    valorant-free-version/resources/updater.exe
  • Size 229KB
  • SHA256 6a80d6e14fe4a088babf44bf8f4de56952db862e98b1f92c3770519d240b0d59
  • MD5 7783127e0f910164e8edd2d600e758fb
  • SHA1 efa0aa5ed2b6ea78c7a57f47cc355dbaf9e84ba1
  • SHA512 d4058f3f2d15bb401505db415b666e3b0a8bb04405b185d500234823069b0dfad7b6265988b150f18f3caae57469ec4debff820ec988390dfd901e5aff2af62f
  • SSDEEP 6144:dloZM+rIkd8g+EtXHkv/iD4KAJxrRiK1pwBzOurBs4Tb8e1mtxi:/oZtL+EP8KAJxrRiK1pwBzOur3p
  • TLSH
    T1F1346C5933B88B17E25F8BBED5B1148F87B1F143E90AF78E0C8895F82411B42E949E57
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryumbralstealer

  • Detects Umbral payload

  • Family: Umbral

    Umbral stealer is an open-source modular stealer written in C#.

    stealerumbral

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral11behavioral12
• • Target
    valorant-free-version/resources/valorant-free-setup.exe
  • Size 78KB
  • SHA256 247f2ce9aeb1d76d233c8e4fe86eaa8aa38629760d27d018f54003b0e2ac07d3
  • MD5 5b0d4cbf88c344d48368428f937a15f5
  • SHA1 1f9c1fd83cf6ae3ae50033e75f61ea080821c0e0
  • SHA512 807ff5c60da59e1e3e3a0b2e64159004aa7925d2f69bf7886b449800e449ec6fa80a0567db401e2f9645d9090cd563bac76cb17ba9b8893af4c7bdb150beef29
  • SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+b3PIC:5Zv5PDwbjNrmAE+b/IC
  • TLSH
    T1B273B8C877AD8903FBBF5EBD147141524B72BB17E935F68D088C54E611A2B828C42B9B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discordratpersistenceratrootkitstealer

  • Family: Discord RAT

    A RAT written in C# using Discord as a C2.

    stealerrootkitratpersistencediscordrat

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral13behavioral14