Extracted

• • Target
    3.pdf
  • Size 824KB
  • SHA256 a6dde2021305f44bf707b879375811aac356af8d966329cb129df4de2fd0058d
  • MD5 6f920edeba4dcb13663936d38eac6148
  • SHA1 70b18ae658c5fc3b3f52ee72cc9a73fbe5b37ec4
  • SHA512 580ac9068dc9ab155a6c2f9c49a0935f2c915a81860ac9ccafe91fa53f1d698b9098cfe379ca5f5361044fd8146c5da3dc7a665dacd257c3fad05920e42a2a46
  • SSDEEP 24576:l0UtBd5co4vi7sMdnFxG+h/99MMwUjtFOkM9jRKfGW:l0wd2o77bde0/rMMwQGV9jofGW
  • TLSH
    T13C05F1B9E9D41CDCEC43CB8665A6391445ADF14B97CC3AC118BC8F86B181F0E9B935E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral1behavioral2
• • Target
    4.pdf
  • Size 824KB
  • SHA256 a6dde2021305f44bf707b879375811aac356af8d966329cb129df4de2fd0058d
  • MD5 6f920edeba4dcb13663936d38eac6148
  • SHA1 70b18ae658c5fc3b3f52ee72cc9a73fbe5b37ec4
  • SHA512 580ac9068dc9ab155a6c2f9c49a0935f2c915a81860ac9ccafe91fa53f1d698b9098cfe379ca5f5361044fd8146c5da3dc7a665dacd257c3fad05920e42a2a46
  • SSDEEP 24576:l0UtBd5co4vi7sMdnFxG+h/99MMwUjtFOkM9jRKfGW:l0wd2o77bde0/rMMwQGV9jofGW
  • TLSH
    T13C05F1B9E9D41CDCEC43CB8665A6391445ADF14B97CC3AC118BC8F86B181F0E9B935E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral3behavioral4
• • Target
    Apps64Help.dll
  • Size 33KB
  • SHA256 16a2b6ba2284a2476d4a345b35502c52a2a98ac0931ce7faf814765f659e2725
  • MD5 4267e963815c81d39b7cb792630bcde6
  • SHA1 b10b62324a8685d5ded99e92a34742a25a7a7a11
  • SHA512 f13247528613f9f7ca9189150f0235b3ba6054892e1573f7eb0de84d0fec10e884dc595a7faf3f620fc0fc52969221c98e0c7efbe46942be6becb693d9f6e416
  • SSDEEP 384:Aa57HaWAvSRJHxLKTEzm0fVZN0cH3FSqHOnmnYPL5YUHeMSLdiOUUip23+r/jLri:Ae7Avkx44ZTVSJmOuLdiyip23+zjFI
  • TLSH
    T171E26C871B5868A3EE86CAB4D4A2E61BDE75F3D05BD411CF1131C2841F92BD23B69B09
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    HH.pdf
  • Size 824KB
  • SHA256 a6dde2021305f44bf707b879375811aac356af8d966329cb129df4de2fd0058d
  • MD5 6f920edeba4dcb13663936d38eac6148
  • SHA1 70b18ae658c5fc3b3f52ee72cc9a73fbe5b37ec4
  • SHA512 580ac9068dc9ab155a6c2f9c49a0935f2c915a81860ac9ccafe91fa53f1d698b9098cfe379ca5f5361044fd8146c5da3dc7a665dacd257c3fad05920e42a2a46
  • SSDEEP 24576:l0UtBd5co4vi7sMdnFxG+h/99MMwUjtFOkM9jRKfGW:l0wd2o77bde0/rMMwQGV9jofGW
  • TLSH
    T13C05F1B9E9D41CDCEC43CB8665A6391445ADF14B97CC3AC118BC8F86B181F0E9B935E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral7behavioral8
• • Target
    MaxxAudioAPOShell64.dll
  • Size 601KB
  • SHA256 ebec0c7ac672dd772fa22b326ab0e5ad9dd8880b71a69942fad0fafca8ad40ae
  • MD5 85ba4681252354f1713bacef19879fdf
  • SHA1 64b93213c5752bbf89b9c08a65d5a29f197fb220
  • SHA512 bc5d2b6e696f606a2afde2a55d503d24e1cc0121eb808cad0f60a67e07af6871cf34cc8d9d2d086044d640730a5f7c45f64b269daa8474372b644131fe2e7472
  • SSDEEP 6144:BC5Lw0eFksHfplbBQ+5nbuzrDIzqF0GA9VvBJEc07iXhZAl6j5IHJfWb1mHx9mbH:g0FksHfTBQPiXhZwwIHJM1m+
  • TLSH
    T199D4B71AEAF610E5E5BAC1389563313AFD7138A54734A7CB97805A0B1B31BE4EE3D740
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10behavioral9
• • Target
    MyProg-x64.exe
  • Size 76KB
  • SHA256 b50952f9af310be586746356508b9fd430dcbbaa155a04e6f9563632de0a023b
  • MD5 2b99efa18ca9132208a73c7888a8f518
  • SHA1 dea37c5984985da472dda61d3b6a4cce462ae6b9
  • SHA512 42c71c058c7ffebb4f6d2e3c8725eae6653dff50d55648576057ee7ead645db76b747cc67d3e864abb4b314f849821f589cc1adbc4db7553e513e672684bb6c4
  • SSDEEP 768:UBB1AKdpLnrhi+NwjGNNKgZ8bmY5/hQ9E08N6QNdA3iPmbL:Uz5hi+NwjGNNKpT55YE08NZTu7
  • TLSH
    T1EE7397C2E382AE4DEF0E70771763856480B9A9B25F036403B70D729E39F9DA0174D5AB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral11behavioral12
• • Target
    XIAO.pdf
  • Size 824KB
  • SHA256 a6dde2021305f44bf707b879375811aac356af8d966329cb129df4de2fd0058d
  • MD5 6f920edeba4dcb13663936d38eac6148
  • SHA1 70b18ae658c5fc3b3f52ee72cc9a73fbe5b37ec4
  • SHA512 580ac9068dc9ab155a6c2f9c49a0935f2c915a81860ac9ccafe91fa53f1d698b9098cfe379ca5f5361044fd8146c5da3dc7a665dacd257c3fad05920e42a2a46
  • SSDEEP 24576:l0UtBd5co4vi7sMdnFxG+h/99MMwUjtFOkM9jRKfGW:l0wd2o77bde0/rMMwQGV9jofGW
  • TLSH
    T13C05F1B9E9D41CDCEC43CB8665A6391445ADF14B97CC3AC118BC8F86B181F0E9B935E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral13behavioral14
• • Target
    chgport.exe
  • Size 1.2MB
  • SHA256 bf5ffeea7173c189bc75a34c6c02620095f6a79ebf67fcd97b6613ab5e079a44
  • MD5 84422fbf18741da15be2fa707292d2d9
  • SHA1 110f5742be29c2ac0180e981755443d9f348f975
  • SHA512 e0478926d3e75e3ea9a02249ae2e00a0fdd4e156e5a313ba05bf0eb819aed55a3775c176cac5c511070ecf07999b59e66ae4826eb2b0a4b3048af7528b13d0a1
  • SSDEEP 12288:8lGhLRQq3BIgCTfDITlP6NG7qcmfT59n47G5+4:BzRIgK4p6w7qcknyG5T
  • TLSH
    T129455C5A666080E0F162C33AC5718A97F7727C611BE1A3DB16A4B39E5F376D40E39332
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorvalleyrat_s2persistenceransomware

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral15behavioral16
• • Target
    glib-2.0.dll
  • Size 1.1MB
  • SHA256 2e6ed256cc0c0e1dbd8d0fbd83818744b4723def05be9c0bcbca961feac56fdf
  • MD5 daa7802f04778cb6287490737ad48c50
  • SHA1 115ec90a6b366e469aca8082524f13be14a4c5e0
  • SHA512 d0d697fd12229a90add7a2effb6541425b1e33144ba98ad4b044f4ab12a0b9ad5288c1b42a9a59efe2422e0028ebe4fa6645392c39eb9118e49422cd26793331
  • SSDEEP 24576:wiLoh7Mu3tDbVt1nqxo/GqMMaeE0YZr+NIZd6tv1M80ap:xkh7Mu3tf1nQo/GqJbE0YZrsoktvEC
  • TLSH
    T110452955E64939A7EB96CC7988E19353E27075080F3366DB3E6CC6691B2FAD30236F01
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral17behavioral18
• • Target
    gmodule-2.0.dll
  • Size 139KB
  • SHA256 49275379def9b8314b399ce347f7615bcf5a2668815c783c5ec560278d2064a4
  • MD5 b36fbcfc62b512b7fe0b40c0071424b0
  • SHA1 d6ff5eb1e1e9df18dec512234b37a511aacc20b2
  • SHA512 f06d48b1ec6d05286c1cc1c47823fc5256df7fd55b23ab6b63273c9f085c0dfd13e1e096b8efa4c008150448706e80f458db444e17339222a9c90fd3c73e17be
  • SSDEEP 1536:15WA1MYgBz3jPEcDezbbnhVbPbgRHalGTeGUTHSSrCjOBrRBJbn3uasW9d39dl2Y:15aPEt3X3gR6menysCyBrR/nZ3gKtt
  • TLSH
    T106D36D5BB7A500BBE4778239C9631645E776B81507609FEF03A4472A2F237E09D3EB21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral19behavioral20
• • Target
    gobject-2.0.dll
  • Size 295KB
  • SHA256 8716833a789cb1bd0c3367be44996f9198138faaeb876a7874812319ff505c3f
  • MD5 f8ed96def23c414c08b064cc13e6e67c
  • SHA1 ff4aac8d31996cb557f65571f5c76206c156acd4
  • SHA512 ea0d87c4fc5e622560c8ae2416461fa8db40a9c404322ffd24f47d95b1d132df42892afd4a90beb73b29ff1656692f424ea918d13c5127a588e1d321b180e03c
  • SSDEEP 6144:qpFZCqYVAWHgAhh+c12xSk5FbYL+W5nP/fijbRV4KNPGmKHTAZTYWu3TM:uFZCqYqWH3hh+c12JSVinR91KYEY
  • TLSH
    T18B545B5DA2582C69EEABC038C642D507D2B374011362A3CF17B487AA1F37AE5F93E705
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral21behavioral22
• • Target
    help.pdf
  • Size 824KB
  • SHA256 a6dde2021305f44bf707b879375811aac356af8d966329cb129df4de2fd0058d
  • MD5 6f920edeba4dcb13663936d38eac6148
  • SHA1 70b18ae658c5fc3b3f52ee72cc9a73fbe5b37ec4
  • SHA512 580ac9068dc9ab155a6c2f9c49a0935f2c915a81860ac9ccafe91fa53f1d698b9098cfe379ca5f5361044fd8146c5da3dc7a665dacd257c3fad05920e42a2a46
  • SSDEEP 24576:l0UtBd5co4vi7sMdnFxG+h/99MMwUjtFOkM9jRKfGW:l0wd2o77bde0/rMMwQGV9jofGW
  • TLSH
    T13C05F1B9E9D41CDCEC43CB8665A6391445ADF14B97CC3AC118BC8F86B181F0E9B935E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral23behavioral24
• • Target
    intl.dll
  • Size 94KB
  • SHA256 2b610cef5cdaafcdb10a2b63de10913912b4b5141ae7d81cece4e9398911d10b
  • MD5 7e9a97dcaa4be1d9260a98461d663efb
  • SHA1 6d245eb746d94ab786444ad42c2c59663833bdc2
  • SHA512 5c909ad401397cd51c091b8f04e8a84c159b620116e3ed0e739a7cc9d2944adb5e96ebda37048ea5bdabb78cced10fcfd26b8ccb73492ff40e590f794b3b5167
  • SSDEEP 1536:8Qdk8l0gArxP3gncYJ8yIZlHQmZtBJwaOW5B2eIlLR8iy80Q:8QaDFxmBiB2aOW5wR8iy80Q
  • TLSH
    T1B7935B8E8A995052D95B81F49496F302CA73B853072C9BDF0A78C3152F869FB1F3B791
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral25behavioral26
• • Target
    msvcp140.dll
  • Size 544KB
  • SHA256 0f885b509a685d2bbfa652fed26b5fb31d88fbdab0a978c641d1c7b8aa460aa9
  • MD5 bc88b387cafa556068b5c5d6ff3ccc8f
  • SHA1 b370eca8fa727e46cf61d834fcc956698b02e1fd
  • SHA512 b7aee12e1bf86027e3c42ae28f6f6fb34dca81c1f5af6983ea4aac559f2fedf945956a381f529c553d71bc83cd71dcbad12266fad86c944f17f63db92b8ca95b
  • SSDEEP 12288:tdkDYbKloU7/7mozO39V5WZyhNFdQEKZm+jWodEEVLa69sU:tdnGoU/7m/V5WZ8dQEKZm+jWodEER7N
  • TLSH
    T10BC41A27F74A06B0E195E3B8A1838702D7F1BC598322E3C752EB955D2F573D0A63B690
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral27behavioral28
• • Target
    pcre.dll
  • Size 403KB
  • SHA256 9524a9ae031af3d1755ef7b14031fa4372a9891622323fecb1a8f0180beb2ffe
  • MD5 eb3eea73f3c326e3c1f3f230765b4a9b
  • SHA1 29385ce198deabd991105e1a0a8fbaacdbfd0258
  • SHA512 58751d2cca457291b05e6969759ac08c15a1d7932515285efafae8fcc963b1f96497bd873a889923bc943f3386b9eb2b643bd7d8edd16950d8235488550ad6be
  • SSDEEP 6144:/kScjFvmztCe0XaHgxhBXzsF3z6Bdg5zDS/fpGY4E9:WtmoAHg3BjsF4dg5aJGZo
  • TLSH
    T13A94294263B500B9FFEBD1374363D116DBBA316C53A35EAF24D05A70BA327710A2E619
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral29behavioral30
• • Target
    vcruntime140.dll
  • Size 117KB
  • SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
  • MD5 862f820c3251e4ca6fc0ac00e4092239
  • SHA1 ef96d84b253041b090c243594f90938e9a487a9a
  • SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e
  • SSDEEP 1536:N9TXF5LLXQLlNycKW+D4SdqJk6aN1ACuyxLiyazYaCVoecbdhgOwAd+zfZ1zu:N9jelDoD9uyxLizzFzecbdPwA87S
  • TLSH
    T1A2C38D4572A042F7D17AD274C1A36A17FB75B94487A0A3CF03B58A650F13BE0AE3D396
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral31behavioral32