Extracted

• • Target
    AI自动化办公表格制作生成工具安装包/steam_api64.dll
  • Size 107KB
  • SHA256 d6387be78d258a820e4cb35ec53c65d52a813b63147488629b56269f6648adc1
  • MD5 3198b729513bf5a65e39be989298079b
  • SHA1 a79a312a5c8884ec4b51aa4d776ba5793de09ffc
  • SHA512 05c6431a07aad1f276431d99beb4f4dd8e247bde96084cbe5ae0bce01ca262827e96a9187aec4d3dd41c08afde594d1bb98217dfe09718bb4eb3907e0f2bde2e
  • SSDEEP 3072:bw0WMZYV7iTQbXAukRJtps7Fo/3e6Uege/EYpVPVZ:bw0xGVQGXAu2iQV9
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  valleyrat_s2backdoor

  • ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Valleyrat_s2 family

    valleyrat_s2

  • Blocklisted process makes network request

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1
• • Target
    AI自动化办公表格制作生成工具安装包/双击安装.exe
  • Size 253KB
  • SHA256 a8a42814c253ca5e93e81be5bd69149ff71b9ac3024420614fba37fb0834b3c0
  • MD5 c20383afabfbd60298b6b2385237a008
  • SHA1 902438f6bcc919f98b195f4de2560a311ff5dcd0
  • SHA512 e844938501c7fe3da490e5d5b0172077829715d137ee1f9b770bbaf1ae1700ed0cb532da819beeba04ce7df926b9c81bc194bf7d5c3eb8c57625dc4aa8dc2bd2
  • SSDEEP 3072:oehT3vurb+DJte4ytrYwFK8zk9J7TL6WxBEC7AVUAQ/J5foY46pjQ02WO9Fc43Lx:Xz4qDJte4yZjQ8zknFnkX+zohQs9BZ2u
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  valleyrat_s2backdoor

  • ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Valleyrat_s2 family

    valleyrat_s2

  • Blocklisted process makes network request

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral2