Extracted

• • Target

    78b8cd9ed9cdfe32f62396f1546c0739b66cf15c8ef5a71d5858358295fc8b15.dll

  • Size

    2.2MB

  • MD5

    cc66527f0069ca11c2f1f51411135199

  • SHA1

    4e3d3f90abc13e451822f20a943a158d5ed1d207

  • SHA256

    78b8cd9ed9cdfe32f62396f1546c0739b66cf15c8ef5a71d5858358295fc8b15

  • SHA512

    71e028b43aca70c2c06fa16226d71602121b3bb78806c098386ebd6d4e255875f498c0861f908ee723139ea8b448f73cc6de1afb3b0c8dff7e3ac77273029133

  • SSDEEP

    49152:L2cV7CFHgGbWJsUqtmNaOhVYcSUuamW5zo76e7+7WVuSwiPSCmDS+5uSlZLun40:NxOAGbWuUmmNaMVrSU735zoWe7+7WGu

  Score

  10^/10

  valleyrat_s2backdoordiscoveryexecution

  • ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Valleyrat_s2 family

    valleyrat_s2

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2