Mystic Valorant[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Mystic Valorant.exe
Size 164KB
Sample260820-dbesyaydld
SHA256 e632bc2dc511f2d03c3243df2c10f46e24a31036bffd5e89825090ad7a5e9911
MD5 036f52d53d3c9fd4c59adc135e7d5f19
SHA1 1030ac8864dd7db98fb3585bab00efc3ee955550
SHA512 5ad29318c5d1e925ebe0b9cd0e2e1e0a9d0ae09e809ae5d105eca3cc3aec0f36e0e2ea04ddfb8e7637831b02b6a1a42509b244b006a919914a16d947a14fc80a
SSDEEP 1536:6lptDBbGt5CL1lWMv9/EFSQjfoZThI+yi1ErWKoH3i+8piJ3W7WZoDjTRvw8mO6:6lBQCL+SCo/I+ybrRN7WZUTRhm
TLSH
T1A1F35B1EA587057ED2E2DDB8CA264542F733B88E1FD165E723D04AF10D276D8AB35A03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Mystic Valorant.exe

File Explorer

Mystic Valorant.exe

.exe 164KB

Mystic Valorant.exe

IMPHASH 1d25191d2d68b5cfddf24515f1f32fea
SHA256 e632bc2dc511f2d03c3243df2c10f46e24a31036bffd5e89825090ad7a5e9911
MD5 036f52d53d3c9fd4c59adc135e7d5f19
SHA1 1030ac8864dd7db98fb3585bab00efc3ee955550
SHA512 5ad29318c5d1e925ebe0b9cd0e2e1e0a9d0ae09e809ae5d105eca3cc3aec0f36e0e2ea04ddfb8e7637831b02b6a1a42509b244b006a919914a16d947a14fc80a
SSDEEP 1536:6lptDBbGt5CL1lWMv9/EFSQjfoZThI+yi1ErWKoH3i+8piJ3W7WZoDjTRvw8mO6:6lBQCL+SCo/I+ybrRN7WZUTRhm
TLSH
T1A1F35B1EA587057ED2E2DDB8CA264542F733B88E1FD165E723D04AF10D276D8AB35A03
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

118024

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Seven\Desktop\Desktop\Bureau\PERM X\Mystic Val\Loader\bin\Loader.pdb

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCloseHandle WinHttpSendRequest WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

shell32

SHGetFolderPathW SHCreateDirectoryExW

kernel32

CreateDirectoryW CreateFileW FindFirstFileW FindFirstFileExW FindNextFileW GetLocaleInfoEx FormatMessageA FindClose LocalFree GetFileAttributesExW GetFileInformationByHandle GetFileSizeEx VirtualProtect SetConsoleTitleA GetCurrentProcess GetStdHandle WriteFile SetConsoleMode TerminateProcess Thread32Next SetFilePointer GetEnvironmentVariableW GetTempPathW Thread32First WaitForSingleObject ResumeThread GetModuleHandleA SetFileAttributesW CreateToolhelp32Snapshot Sleep GetConsoleMode GetTempPathA GetTickCount64 GetLastError GetFileAttributesA Process32NextW CreateFileA GetCurrentThread GetSystemDirectoryA LoadLibraryA DeleteFileA Process32FirstW CloseHandle K32GetModuleInformation SetFileAttributesA GetProcAddress GetCurrentProcessId GetProcessHeap WideCharToMultiByte CreateProcessA OpenThread IsDebuggerPresent GetExitCodeProcess SetUnhandledExceptionFilter GetFullPathNameW SetFileInformationByHandle IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive MultiByteToWideChar UnhandledExceptionFilter GetFileInformationByHandleEx MoveFileExW CopyFileW GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead AreFileApisANSI

user32

MessageBoxA FindWindowA

msvcp140

??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Mtx_unlock _Thrd_detach _Cnd_do_broadcast_at_thread_exit _Mtx_lock ?_Syserror_map@std@@YAPEBDH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Winerror_map@std@@YAHH@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy memcmp __std_terminate wcsstr __std_exception_copy __std_exception_destroy memmove memset __C_specific_handler _CxxThrowException __current_exception __current_exception_context

api-ms-win-crt-stdio-l1-1-0

fputc setvbuf fgetpos fwrite _set_fmode ungetc _fseeki64 _get_stream_buffer_pointers __p__commode fgetc __stdio_common_vswprintf_s fread fclose fflush fsetpos

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc _callnewh

api-ms-win-crt-runtime-l1-1-0

_initterm_e _beginthreadex _initterm _get_initial_narrow_environment system _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _register_thread_local_exe_atexit_callback _c_exit __p___argv abort __p___argc terminate exit _exit _invoke_watson

api-ms-win-crt-string-l1-1-0

_strnicmp _stricmp tolower _wcsicmp

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr ceilf