Extracted

• • Target
    Chorme_setupX64_v1.9.06.exe
  • Size 109.5MB
  • SHA256 a92ecd1a211c7114b9309c6706189edcbcf982a261a66d8960befa1fbb73e9b4
  • MD5 a34222a7cd1e0267d11f26cfe77b04a3
  • SHA1 afc81f8f0284ca11b97b22465e16db58060282fc
  • SHA512 cf59096226fdab6008e03d13124569b2404c2d237384deccc16079c4ec138b9939019c29b34af0c472a0312583fb02b85bd3859761db625ebcceb25c3e282fba
  • SSDEEP 3145728:LGZd/N+XPzs5IM7xiV+cwFnvreM2RcGjy8gw:C/18PzsKMuwRvpcju8gw
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionexploitvalleyrat_s2installerpersistencespywarestealer

  • ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Valleyrat_s2 family

    valleyrat_s2

  • Possible privilege escalation attempt

    exploit

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  behavioral1behavioral2behavioral3