Extracted

• • Target

    2025-04-01_f1795a8e111b967491cefe7438f38267_black-basta_icedid_luca-stealer

  • Size

    21.8MB

  • MD5

    f1795a8e111b967491cefe7438f38267

  • SHA1

    ec6783287f8fba0a53534b88ad027799f054e023

  • SHA256

    3d20d079d777d5c179d709428935d51605d82a8668ac716eb89f8249c46adb8d

  • SHA512

    a70a16730a858bf59f0c18274b2251206ab0136a34237447a3b1fa624c1c19a7ff8c431b7352534d739770d5b9674bd043199d1461584bc9366feaeb2e7014b9

  • SSDEEP

    49152:XciUvXVc5YlG4V5EXHwCC5hDOng6kpicavOafd4+9mNneuEBELEMjFRwV:sislc5YlG4fnzDOnREoQBe

  Score

  10^/10

  valleyrat_s2backdoordefense_evasiondiscoveryprivilege_escalationtrojan

  • UAC bypass

    defense_evasiontrojan

  • ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Valleyrat_s2 family

    valleyrat_s2

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1