Extracted

• • Target
    valorant-scout-v2.3.1.zip
  • Size 1.5MB
  • SHA256 5da769bca0e10cced59d85965ae6ee3c66a6443680f390095b655e7862e032a1
  • MD5 bf5dff11b26a20c375d2f96f517c253a
  • SHA1 5a6eccea1def83bbaf18faa48c0da4c0a2af22b8
  • SHA512 b352fe4c3981b33ee1873959d3fc6b9d1a7714145f23d4d072bdfe9ce7f86d1ba12f8c14573669af6cd8c8a2d17113fae5226d6106707a997a8d44649afc6795
  • SSDEEP 24576:YwofpQH+chnHica7VFr0rM+bdTfLeIQ3mQ9eop9QeRBJaC1p+bnduU+ZKUstmm4/:AhgnH8VqndTf+mz4ZonRYKBmd8MBR
  • TLSH
    T162653379C1C8A6B3CA355136DC12071E9395137B1A36CA0A1139EE881D36BD63F5CEEE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    install.bat
  • Size 185B
  • SHA256 c6b233dbe64a43b62d9b21b00e4b22fba4f89616c26e03dfb329179bfe4945bf
  • MD5 911d9e1885d3a3b1d470a534d99af07f
  • SHA1 1474779999ef0bf6386f94a28b643b5157ec10d2
  • SHA512 fa25b95499e4c4a78e14b341b3daa2aa295186909a717102ffa0762e9b08b935ae4d463d95360d299392b7646e04ba0e4ababafecb7868436bf04cdf0a3e81ce
  • TLSH
    T1A2C022002E1F936C14639C1671A1946CEC7812CA9312D8427132202CB80C340DA4A2DA
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywaretrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4