Extracted

• • Target

    2025-04-02_0ca9e4cb5777ad028ec438cc21182b4e_hijackloader_icedid

  • Size

    22.2MB

  • MD5

    0ca9e4cb5777ad028ec438cc21182b4e

  • SHA1

    c17c086b6864e7194247a8f7ec79927a09e18f5b

  • SHA256

    6a8e70f36c2b5dea66a76245d23b079899b958c584358093516f602f237da7f6

  • SHA512

    777fe56da072eb2089889835d0d406b767a254d8b76faf2bd4e65e41357e12760f141c641f1b7dc5e6386dc748936d77acc565b458aff27655b9ccd49b0de605

  • SSDEEP

    49152:LQ6/BNDUplG4eVdEZma5bVI5rUNkPAhb/BNlz/gYCQLF0v1QNneuEBELEMjFRe:86JNDUplG4DbBsKB0

  Score

  10^/10

  valleyrat_s2backdoordefense_evasiondiscoveryprivilege_escalationtrojan

  • UAC bypass

    defense_evasiontrojan

  • ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Valleyrat_s2 family

    valleyrat_s2

  • Blocklisted process makes network request

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1