Extracted

• • Target

    4f13d4a71a5c335c0f3cf15b31dcbdd42cf9298ceb63be0bf1846233150ecea7.msi

  • Size

    5.2MB

  • MD5

    cdec46b72a3d0ee11807fd836fb1a6a1

  • SHA1

    d917ae9aa96183fabc5741c24ee092a1996e3b07

  • SHA256

    4f13d4a71a5c335c0f3cf15b31dcbdd42cf9298ceb63be0bf1846233150ecea7

  • SHA512

    3ce9d1c2f37ebd029988b7970584bb73aac45680720953a7f4030b87d0e704fa7e42af5261eaabf0e975b464ff150282805b5106d54f4131d044719298503271

  • SSDEEP

    98304:7yXtlFC2Yj0r1V9kWbezWqsfuCYQwev/mpRt9HOeZ9MDRrPa17o:7ydlQ280r9kYAPsffYQoOm9qRrCx

  Score

  10^/10

  valleyrat_s2backdoordiscoverypersistenceprivilege_escalation

  • ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Valleyrat_s2 family

    valleyrat_s2

  • Blocklisted process makes network request

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1