Extracted

• • Target
    2026-01-19_f7e8a2c776ea80867c6c901c9b496758_akira
  • Size 14.5MB
  • SHA256 11be40cfa3b78482e061bd23d0ac05b299cb69e2d30bf297d086cce123a362f6
  • MD5 f7e8a2c776ea80867c6c901c9b496758
  • SHA1 3ff323be6f32b698e48277b5427aa6c823ee658f
  • SHA512 6a1d86d22a3fbd61a539c0663478ce8b87f1ce94405d72e7b56149992d4e302be2a35c5d4c8eaa0c1fc75b9fb9fb46b7507ca2ec3d722e44bbbef3010ddc6cd4
  • SSDEEP 196608:3ZY+c/9qrpXaE221XERJ78mDyaGWpwkmhN65CRi5daXPv70XdDegqW:3ZH5I21XE378mepWdnrU7aR
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  backdoordiscoveryexecutionvalleyrat_s2

  • ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Valleyrat_s2 family

    valleyrat_s2

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2