Extracted

• • Target
    2026-02-05_08b661718f9d5ab2b040afc88edd473d_akira_cobalt-strike_quasar-rat
  • Size 4.2MB
  • SHA256 4d84747ecc98fc8af895f41443745fd80260d49b22cea30980e166b8501ab7cb
  • MD5 08b661718f9d5ab2b040afc88edd473d
  • SHA1 a8e2e79b7da51dcf38448c1e2bd3216a0827b273
  • SHA512 313fe287dfe30abc1d17d0e6a4f3cd63de84dc9f31cbaa88433495d515a1376b2b6b28b05cc8e99562ed05f7757868c63e38d2df38e19c7b86fabcd2c4b87850
  • SSDEEP 98304:+NHbjUJfSKmDk+4GxDKrQH3HG/wsB0EpJgkHDT21:BiDhdDfG/wsBJljT21
  • TLSH
    T16B26E002F5F1F6ACC556C270531A9772A635BCCAA6307A7F0AE4B7302E75D604F18B68
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryexecutionvalleyrat_s2

  • ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Valleyrat_s2 family

    valleyrat_s2

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2