Extracted

• • Target
    2026-04-09_8639de1014ac3c7230f128ec77d1cd00_cobalt-strike_icedid_luca-stealer_njrat_satacom_vidar
  • Size 355KB
  • SHA256 e8bd02f671b2724d44c54babae21b99f6702622def7a26bffabd2c2aded35758
  • MD5 8639de1014ac3c7230f128ec77d1cd00
  • SHA1 b417952ee03a292d4084b2dde897b851f25bd926
  • SHA512 e026f29f8ca0fabee8bfd1005f9526c12021615857b0a7e6ca49e3e234e1d557fe1fc76f0c64e04f91b39be41e15eab65fbd002961ef20cccde95845f39e78a6
  • SSDEEP 6144:ct1ohH3syj1VZ4P+R4cUT8RBfKEsWfm1G4Y1r:ool3syZVZ42RUYtbm1G4Y
  • TLSH
    T1CA74F443A6EC3CEAD0769274A77743C6D72EFC5502A0C62F02E042969E3F253792A7D5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryexecutionvalleyrat_s2persistenceupx

  • Detects ValleyRAT payload

  • ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Valleyrat_s2 family

    valleyrat_s2
  • Custom signature

    UPX dump on OEP (original entry point)

  • Downloads MZ/PE file

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2