Extracted

• • Target

    AI自动化办公表格制作生成工具安装包/steam_api64.dll

  • Size

    107KB

  • MD5

    3198b729513bf5a65e39be989298079b

  • SHA1

    a79a312a5c8884ec4b51aa4d776ba5793de09ffc

  • SHA256

    d6387be78d258a820e4cb35ec53c65d52a813b63147488629b56269f6648adc1

  • SHA512

    05c6431a07aad1f276431d99beb4f4dd8e247bde96084cbe5ae0bce01ca262827e96a9187aec4d3dd41c08afde594d1bb98217dfe09718bb4eb3907e0f2bde2e

  • SSDEEP

    3072:bw0WMZYV7iTQbXAukRJtps7Fo/3e6Uege/EYpVPVZ:bw0xGVQGXAu2iQV9

  Score

  10^/10

  valleyrat_s2backdoor

  • ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Valleyrat_s2 family

    valleyrat_s2

  • Blocklisted process makes network request

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1

• • Target

    AI自动化办公表格制作生成工具安装包/双击安装.exe

  • Size

    253KB

  • MD5

    c20383afabfbd60298b6b2385237a008

  • SHA1

    902438f6bcc919f98b195f4de2560a311ff5dcd0

  • SHA256

    a8a42814c253ca5e93e81be5bd69149ff71b9ac3024420614fba37fb0834b3c0

  • SHA512

    e844938501c7fe3da490e5d5b0172077829715d137ee1f9b770bbaf1ae1700ed0cb532da819beeba04ce7df926b9c81bc194bf7d5c3eb8c57625dc4aa8dc2bd2

  • SSDEEP

    3072:oehT3vurb+DJte4ytrYwFK8zk9J7TL6WxBEC7AVUAQ/J5foY46pjQ02WO9Fc43Lx:Xz4qDJte4yZjQ8zknFnkX+zohQs9BZ2u

  Score

  10^/10

  valleyrat_s2backdoor

  • ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Valleyrat_s2 family

    valleyrat_s2

  • Blocklisted process makes network request

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral2