Extracted

• • Target
    Hwdqiniweb.exe
  • Size 69.0MB
  • SHA256 c2132d200b9d9e3ad33e27d2d1707b5bd3e5941f4fdb1a00555fedca59fe2c67
  • MD5 823e105ec35944c01eadbd4bc717e2b6
  • SHA1 9fee74a633b425844ef39ddbc4573a0ad7df9d9b
  • SHA512 19913a8fa7695692f242323d296845c2e9ed5e7776cd2829368b72446722596e6e8c0b2e0bd497b3061fecad45613aec1189c4427c7d18c5d4bf86d553728a38
  • SSDEEP 1572864:7fOBeUBsY8N/bQQhxWIWnj7zY+WUSLBKM2iP3yg:7m0fVUeWIb+WUuBxPig
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  backdoorbootkitdefense_evasiondiscoveryvalleyrat_s2persistencetrojan

  • ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Valleyrat_s2 family

    valleyrat_s2

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2