Extracted

• • Target
    配置清单.msi
  • Size 2.3MB
  • SHA256 adfc8fbe77044af27b8b6ce901c384d786e1a34124ece6cb743f3a5c7a4d303e
  • MD5 93a10bdfec266a8deada0d6f7b294d06
  • SHA1 7ba97a13d1842e8ca51c92b9b23b273a97191252
  • SHA512 2069ef3ff74bcfd633bb761af180f30a7ad27a1f63172d7068f5f2767242210c5b5e72047fb70e02b6d0c50151db50196caec7ff2625aac0449c39f99a117acd
  • SSDEEP 49152:9ueB+TEanLBm/usqOVX7Gp7ADREFClUDxuj45G178g46CPT6RQgo:YyX0lFC2YovPT6RY
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  backdoordefense_evasiondiscoveryvalleyrat_s2persistenceprivilege_escalationransomwarespywarestealer

  • Detects ValleyRAT payload

  • ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Valleyrat_s2 family

    valleyrat_s2

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2