Extracted

• • Target

    Google aIc Browser v1.4.1.exe

  • Size

    83.8MB

  • MD5

    d62de6a53a4ab61def2c33c19423fe75

  • SHA1

    24607d81474572149837d2c06b644e328997080e

  • SHA256

    0efc7a12733cab4458e5ffaec5060e2bc8269e198fe03e8b81e78fd3f923a3dd

  • SHA512

    b9eb33a6b082c6f193e97d65f0ea8a01b5a66a43181e3cc2d0d469aa4e72113747c531e03a3fb55ac80131547bb84def346c34a6355d0b6915b009ad1e846908

  • SSDEEP

    1572864:gnU4QJmFhXw6H2Pso8/5Cik3D7Mg0BoQ5QzR0FT3x0YH4eJl21MyV0q0EFxrBY:gn93Flw6H2PO5CikEg0BoQLFFZ4eJYfM

  Score

  10^/10

  valleyrat_s2backdoordiscoveryexecution

  • ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Valleyrat_s2 family

    valleyrat_s2

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2