Extracted

• • Target
    1301202616181.png.ps1
  • Size 287B
  • SHA256 a329c8db66a6182a8e51eb241c503fa1c8df7e4bff4ceeec2ea3ef29b73d55b3
  • MD5 e42d5ee4de7ac1b19db665eae0bd721b
  • SHA1 2c9f490c3bccae8871d7e31da9323d901985f82e
  • SHA512 a59124dde27b16754d9484e6698cd9a0839abe473699f2b04bcf2c8a43ac278d50377924c3e4473568f46be53afe8fe132c93fe8c3c4b658f1f0280d9b80212f
  • MD5 SHA1 SHA512

  Score

  10^/10

  backdoordiscoveryexecutionvalleyrat_s2

  • Detects ValleyRAT payload

  • ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Valleyrat_s2 family

    valleyrat_s2

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  behavioral1behavioral2