Extracted

• • Target
    Tax-Number919863.exe
  • Size 24KB
  • SHA256 233086e7d57e16523ac3463df306cfc497a9ba3c3e8268f62c8625ef56b2380e
  • MD5 3c305f878c678e9017e3e53fb6020283
  • SHA1 b8f157d19017065ccad21e5ceae21184d0fc3e5d
  • SHA512 7783d325bf738dbbc2a35545e2aa31d672dbab7e255720d83a9da66ce885eb0a60853211e95748f8bd3bcd3c470f2a9e8d10bb767b02f8a14511cec6e748e7ec
  • SSDEEP 384:8qRg0yFtNq5Awt9F7heZBLy8RbmL4nNyGu0:eFnq5xtgBL5AL10
  • TLSH
    T1B8B27C67CE500CCBFE1A8AB0A0E59227FC32B6999ED1D3C35378C1550F513817A9A2E9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryvalleyrat_s2persistence

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Drops file in Drivers directory

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    jli.dll
  • Size 362.9MB
  • SHA256 2a0b3f4f734fa6dd6e1fb8b8cb667b67fde0811c1b826db4b7a967a2fd7489a9
  • MD5 54ebfd863c43fa81739905481aeaf2b5
  • SHA1 5456ce649df3b6fc270b95ecdd3622a28a0dc1ce
  • SHA512 eaf8c822f28defea1ad95f51a58305e9dfd469a363a26e0be53f3ac4e6456c11417c3400ed0ef765513e747c3d319805bca6b51112fc7129ad7ffcfbb5082d13
  • SSDEEP 49152:5miwfzLdmqZCLzseyb2jEem/M0ALeE4n/pB5dXkzzspv:SfzF7Yhm/M0ALeE4n/pB5dXkzzspv
  • TLSH
    T168098D07B3B01AA8F51EC5348767963ED172F86347658D8BAA95E7093E33B804B3E711
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  • Drops file in Drivers directory

  • Executes dropped EXE

  behavioral3behavioral4