Extracted

• • Target
    2026-02-13_01fb67072bf23f6eca8b97efce7fd7b4_cobalt-strike_cryptbot_icedid_njrat_satacom_vidar
  • Size 8.6MB
  • SHA256 6318fc904ce497c6469ed747e35203101f9030d36fe8e39b09d2d0806e137b9a
  • MD5 01fb67072bf23f6eca8b97efce7fd7b4
  • SHA1 64bf823bd2c6af5581add28fd4617a98297e5b5c
  • SHA512 fb6448e2886518da3b58441c3fc371a1245cd698da9b9014ee7497c0bba0587c19a99c27ea0ba596a2f7044b2152bc24651ddd5924a930da41fedb3e8fe94948
  • SSDEEP 196608:Q0+SBCnV60E8CCssjwDD1m1cv5RznV60E8CCssjwDD1m1cvZ:MUvvF1m1Q5RzUvvF1m1QZ
  • TLSH
    T1FF96E09532A0C797C906FF7DCC919A5A5F7BEC332E868A0E2040B196ED3375C6C06DA5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorbootkitdiscoverygh0stratvalleyrat_s2persistenceransomwareratupx

  • Detects ValleyRAT payload

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Gh0strat family

    gh0strat

  • ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Valleyrat_s2 family

    valleyrat_s2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2