Extracted

• • Target

    cheon_H4.03-X64.exe

  • Size

    88.8MB

  • MD5

    ce1d8c9970b30019e5b35b7ba968107b

  • SHA1

    b1e0898deac62e2a763bbd67e973c60d1d2b7267

  • SHA256

    9c0f551fa5e93c3f30c90d89f49d811296f84cdb17c45c005559125c275fb7b7

  • SHA512

    1742082598e15065880915168f9958b7ca7b2b8232047836d3f67a78538eec9ed21618c8f5e1b60f321e08a381162aeca3227ff0150cce688ef350b438f9cc2d

  • SSDEEP

    1572864:4W3kvckR7qEWlVaDkRqDX4beH5HY+9OY0AbOb84I8FalUxTv1+:4WtW7jCcIqWeH6SOVXI8Fai1+

  Score

  10^/10

  valleyrat_s2backdoordiscoveryexecution

  • ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Valleyrat_s2 family

    valleyrat_s2

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2