Extracted

• • Target
    SteupsHR-V6.5_6.27_canwo.exe
  • Size 100.0MB
  • SHA256 f4b3589cd1ac577b0f6b95ed365eac6e68aeea1d5abce55f6076d62ab10bcb31
  • MD5 2f694ee7db40b90c1501d0092caad489
  • SHA1 cc054ab1b5880057700d4faa0f5c153e29481e8a
  • SHA512 e11a1a34057d733e85a36a9ceea3884936cb5a4a801e6d7f0087102a6d7c6008b5d50e4565f7f374b838fc5b6f7b3869daa00b1f237e0bc4d7acb797f29e908b
  • SSDEEP 3145728:uqpyJighQuiVfbfSc1IilYEn5xTHG5TydSzGeFnk:uyyJhhiVfbfS9ilY+MOdc59k
  • TLSH
    T1B83833A4403C86BDD66B5739D0DF124E25F0792E686B90FCE60878F935B2149E8FF468
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryvalleyrat_s2persistenceransomware

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 25KB
  • SHA256 c7dd8cc8323e295b8821b0e320de208a7e20c068a8be8d03857520451ce9ded7
  • MD5 4abf19a47044ec746aa8c600f0bc149f
  • SHA1 69da1e4f654b044d7b3c845c12a07c988bf26eb8
  • SHA512 65727cbe3f03e0dceba06d206054e60adba321d29159b4bfb690c30b2ccd1a0a05a08c2aa50ac270fcd28557f4b482f492c36b0d7b7b980b477cd8971559610e
  • SSDEEP 384:jZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvH81Q:jr96YIrx7lC7vU/kaG9uLmCdb
  • TLSH
    T1DEB24C07F38398BFC51BC17186EF5772AA32BE211B616F6F1220F5756E24EA0871DA14
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 14KB
  • SHA256 a0a6431feb4e09018d99acdc02f2139fbacd68420b0f84d4b22a9e091aaac707
  • MD5 48452d7f73a0e73b62a16b4c88068a60
  • SHA1 ef5a3edd25cf3cf664e93c38fbe9034ce652d117
  • SHA512 83dae4699678c2eb245bb3a5758b9decdae308042bf50a36266222a9c20f197503baad9f58f2522c6bfe32ad62b8af6ab6b8f99f2e51b72383f6c50d4d699274
  • SSDEEP 192:PZWhF6MuqMgfdPvg/YWkNLiY8vSKXS6Hn5gIIblaks8NHAHPEdeqe4KFz0:hWh4MFv1w/YWCLXASKi6nAlHJAl4KW
  • TLSH
    T13852191B7B42962ACD0AE374D5EF573322F3F4551138370E0669DB49BFE1660DA39288
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    Uninst000.exe
  • Size 65.4MB
  • SHA256 13e4a52d973354a068cb37af56696b3f2c1fc6c953d0d7147c1578c4d3da95e1
  • MD5 968b9bf3fad397fc55f001759fc96668
  • SHA1 80256c0459dab618f40fd77418200bdb7acfeac3
  • SHA512 3be7315221a8c7fe2a1c4a5624cdca3fb812fbc3afa75b128e461632ab0f505acc81edc7c49f7b31d0902519e2c7086213e8bbc641196a335981aa5457619070
  • SSDEEP 1572864:iTZANd+l3AvVnie8J/yij45IDlNE0fbw4vA4BE8eJTzs59ogDr2mzjA:ic+lYVGk5E40fJlBE8as/oudfA
  • TLSH
    T16BE733A4003CD1F6DAA78B38A0DB121A50F47DA6A99750FCB24674FA75F7189C9EF070
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  4^/10

  discovery
  behavioral7behavioral8
• • Target
    $PLUGINSDIR/DuiLib.dll
  • Size 1.4MB
  • SHA256 e16e2a9c1c1de0e124f6be079015bba56009ff4c075dec20ceb5062818f2463f
  • MD5 1064eaff8e6a39834d135dfd64b1b4e1
  • SHA1 acad8b882949f7a40827ace8ec100178f77828c3
  • SHA512 52ddae50b4eed8b09fdba7b4251dd2e71453e84d2655e29ba4c4885e70e66ba143e50afb3185de1a9d375f3f8b948f81069894b590fbabdb9c6f9674b30c189a
  • SSDEEP 24576:aIrDSosk4sgOIArErW6pYzPeH+44E+/9KgtfMMo+3G9TrLAa9v:aPd0+o5Po+3kLAal
  • TLSH
    T170658E1278818072FA6692329B3CB93D38BDA5605B3487C753CC0D3E4D669F29A357B7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral10behavioral9
• • Target
    img/edit.svg
  • Size 1KB
  • SHA256 8113c0463fd6f5e4db0b112e129d8a2478e7c886bd0112f1bfcc43182952c8bb
  • MD5 fcb0d14e434e8d238ff383cb72bda605
  • SHA1 9c5f323b160798937476f3a0fc71a4f7b658a0e9
  • SHA512 e649392c701890c161c426fe2f54b30c0a284bf375aedf2001f308ee132582a4f5f7b695e9fcfaf1ded9818f6c4a9c33ae5ca41feeca8597331b7fda43127f94
  • TLSH
    T117412965825CD534C260450AD29CE6E4D4D3A2C7CB6A3105FA5F2236BB39C5F6C371BE
  • MD5 SHA1 SHA512 TLSH

  Score

  4^/10

  adwarediscoveryspyware
  behavioral11behavioral12
• • Target
    img/logo24.svg
  • Size 2KB
  • SHA256 489d4a8a3fcf04c13ead3344e743ed3c9286c97db17557d27baa0f13bbceb97f
  • MD5 3465d4f6eb168bff6190e44f5d43a877
  • SHA1 7f49a0535ea8fcc6d3b605669eda702f5253b976
  • SHA512 349f746c18c7c514550070c597883f0c32b8368702ff74bd6a28bdcfbb98ae68490457db61392786cf398b80935ab3efa21e717b35c77d220f48d67fa5fe9516
  • TLSH
    T13D410EFB86D926E1E14AD3F4E90D95EA715638FAAE7DC68406B03A5BAB110DD480CD40
  • MD5 SHA1 SHA512 TLSH

  Score

  4^/10

  adwarediscoveryspyware
  behavioral13behavioral14
• • Target
    img/tipwnd.svg
  • Size 516B
  • SHA256 6e8e948db3ffd1e7c8437655c901a168897dfb5270039676cdaa1f8f3cdbc8ae
  • MD5 c334834f3f9bdabea014ade51f53f437
  • SHA1 c7b85aebdb907c0dde6c680a21f6d5148ab56b5b
  • SHA512 d28e5668e8a152d8307c0ddc6c2107a54491753fc89a7661a56f5dbba9c3170ce15cf84ce085e7cb19458f47ffcfd7729ffef4d40964de39327806c86bc0e545
  • TLSH
    T1B6F059EAA72D0C75C6018B39832CEAF1301250BCD7150114B9E0332F71D852BDC3A7A9
  • MD5 SHA1 SHA512 TLSH

  Score

  4^/10

  adwarediscoveryspyware
  behavioral15behavioral16
• • Target
    $PLUGINSDIR/installer-helper.dll
  • Size 787KB
  • SHA256 4be2e2f848648f87d1682ae40cd069280a4a3de0627261183f39ca2a5203c906
  • MD5 a383e737b8d11424c8c0d6ff9004ac94
  • SHA1 622a86fc42286207b5840e71d4832940a578b3e6
  • SHA512 4395176c83dbe4c7cb31114d99a62b70b266b146b68b4e661d07883660ab51cdee1da903f880efe65eef6c4e0a566d42690733ad2e3b16e698874359069d9cad
  • SSDEEP 12288:gHMJJeQNFHdC587kft8TtS8afSKSe1dTaVT/EqytiWmWERfxDc22GlKLHLhV:P3TdLkARKRTaVrEqytiWmWE3Dc2daLhV
  • TLSH
    T125058E117980C135F5BE0432593CDEB618FEB9210B748ACBB3D85A7A5E705C2AB39727
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  4^/10

  discovery
  behavioral17behavioral18
• • Target
    VC_redist.x64.exe
  • Size 17.9MB
  • SHA256 90e48ade404e4576d023abfa374f323555f233982a8805ea9ac63dca9491a16b
  • MD5 bb2063bbfe319d17b18d8f506efb9b8d
  • SHA1 6e6012844d636aa7b28067554d6fd0bfda393097
  • SHA512 3dece58f72ddcb2574c33bd4cc41fde8b4304c5bc0a9e6a0cf9eb9e095a389f5659462475ab366a6d8a6820999fd5f03ab17f865c921c481632b236a05ee5b35
  • SSDEEP 393216:P6C6pMxhgFCXoBX7Zw9XI3+8pQT4zLk5yn2mZfkjhQEHUf/:P6C6OxOFCXop7Zw943+S3kgnfaUf/
  • TLSH
    T106173333A4224177F7B104B3A528E3703E7CB3186B5999B9C7C8FD483A64491A6BF617
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  4^/10

  discovery
  behavioral19behavioral20
• • Target
    VC_redist.x86.exe
  • Size 6.7MB
  • SHA256 b6ab675f0a27e6600f9726e75dea08d99c15f8ea4b842a2a1d988fa9529d39b9
  • MD5 053c6abdfd2f448b58b57dfd23c49e39
  • SHA1 50e5c7425509c359074b6e7483d2781b4d305b4e
  • SHA512 58a32cd725fb36273e6576c0bd76b8a962f0e5411580cc50aeaabe80a75becb8fed43b018b2d4bd483e6910bedfaa3491dfba8eddc9e96855db851eeef3f5cdc
  • SSDEEP 196608:rLZUAOiYv1lQ9SKu1Yf1Fszdcno1PRKF1EvBmtrN:xU94Syf1FodcaRwE47
  • TLSH
    T1E0662332A4B54032F7F50177BA2891303D3CE728276198ADE7C8AD1D79688D2B7F7256
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  4^/10

  discovery
  behavioral21behavioral22
• • Target
    aacenc_utils.h
  • Size 7KB
  • SHA256 f17016ce1e335a0a5fba9b95a3272fb2f69c055168a7c558df6bc208ea575cf4
  • MD5 bd89c2a91939d0adf53b820bf68901e2
  • SHA1 f3cd9235df895b5ac8e4d11136c3762b812023ec
  • SHA512 9b1e1a0e31c45809f312104daecc66ccead3477e851d9114fe4f83661fca73c4085d90cdb78aeafb0fdbb5fff7ef7aaaf24f35a5bafa12eda314f1b228f28f14
  • SSDEEP 192:QguA3VK4w/iQ2xIrx2flhky1mBi/aLgniQv7Ey5QnEi2tGvJReRXg:FuA4zxaD55P5nM0Rw
  • TLSH
    T184F1F7156AC24A3829436D6C6A4F91A4F01F41BB73F99D80B41CD2A13F49CB863F5EDA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  executionadwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral23behavioral24
• • Target
    aarch64/pngdsp_neon.S
  • Size 10KB
  • SHA256 008756c716ba48937ee2d6b7542f9b19c1055bbf285c2106acf276f64b6e0c67
  • MD5 4d1a2d35a8499342bf07ffd23d7cca08
  • SHA1 0ff0ecbd2bbdc737fe393ad39bc1ef6c2d17daad
  • SHA512 a1d014764d807424f99760b6f4503dd92fb6f5121e7609f20925cabdbc13ed121c7d3b8109612ac637a9713c4157ee77fd8fde15605eb95fad2db40915655e43
  • SSDEEP 192:tuA+8FZ1crTVKLZ9wJWcg/pBh9HMe6nrDrRRKgW8q5GWkuBjzCpDPMPD8MGMi6oL:tuA+8D1wJgpP9iV25GWzBn+CZrDgEg
  • TLSH
    T13E220192B4A69EBAAC0E93394A632D9B4110B4036314C47C730FD7DD5F172A993EE5E1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral25behavioral26
• • Target
    avcodec.h
  • Size 107KB
  • SHA256 909f5c2fe7caf26601c39cd96acbc6f58f49ec5a78914d2e5b524a3fc2571afc
  • MD5 357c8ca37e09032a4962d358bea43d14
  • SHA1 6f3f1ab3cc2580073ae0ac6f8f8d84157ff29b4f
  • SHA512 e1c993776cfd9bd68c66b750435885e955c70e25a826c8f891b7675c8330ae3486090507141b1d9c62b2555f76615f7de45f56fbb37bcaec92118bcc5c3bc268
  • SSDEEP 1536:yW5YqmrQE9hYD/rWupTqu1fUmuJ2IylIslLoKxx62HMws6bkdvDOWo:yW5YR0rKJ2IyvoCRsL6
  • TLSH
    T170B3741766D512221B5208B1274A9AE5D31DF13FB2B155D8386E02BC2F84F7693B2FEC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral27behavioral28
• • Target
    cinepakenc.c
  • Size 48KB
  • SHA256 664c4b332da078e384805d024a0d611ae80fd80b365e726f01da1433d430f98b
  • MD5 921fe0addcc1803e37375ea1bdd569d4
  • SHA1 0cca3741b384581eee5694af5747df927f6eea9e
  • SHA512 7d92e4e77dd653a8c59ef45030e8cbefd043ff8e16bcf2492e20049455a45f287fcf287f583ee76c87af64ff379aa2607d01aa548b6f6353f09d94ea554f2754
  • SSDEEP 768:PKEXYhye5FhfR4gpW1deZyL9btLAyw8t5ZTQev1GVQX1c1:PKEsye5FhfR4gpudeZyL9bC8bZTQe1C
  • TLSH
    T1D223856BD1D21AE63BA394394BDF9000522EA4737545FE04BC5D53A03F850B9A3B1FBA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral29behavioral30
• • Target
    elbg.c
  • Size 17KB
  • SHA256 720e1ad978c0546b52aee8e3485d548dda148cffced48e9ac292ad2ac9dd9a80
  • MD5 3331bec867b09adde6b29c332eca74df
  • SHA1 7ebddd34e1019dcb708f33a6c573a3418390aba5
  • SHA512 93e60f68a4d1f6b2e95460e5222b92a4d88338cb9a47200ad60d699779855d13fdf47e2758c7cfb4a48ebb96f130a2318dd9953cd37399ad62b990cca590e1e9
  • SSDEEP 384:PuAE+9nDGmntM9nk+5vXiC59MRNNNZg7z0:PuAEcnntMxn9MTNNZuz0
  • TLSH
    T1F98295410B9192AA666A78F23BCE70A5215EC46335E0F853FC7C53140F89274EBFE798
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral31behavioral32