Extracted

• • Target
    9068907b67e7f4f97fc12852ce5e1ed760b4ffdd4448364fd8354fa1ec92a61e
  • Size 2.3MB
  • SHA256 9068907b67e7f4f97fc12852ce5e1ed760b4ffdd4448364fd8354fa1ec92a61e
  • MD5 236be53011f034b2d3a199c5235fad5a
  • SHA1 23695b917a5d2d6b3cfa0727437441d8335092e7
  • SHA512 a95ca09cb96265f2fd8bdefff8f0f033855244b9e3ef321426e1439f11c179a330c1a19be8c01407b5d2c93824cea3db3b099ba5b42397a7a4ee86244a1403fa
  • SSDEEP 24576:3hRbWMNqM9+DHEkKbERjJcc+kxLhNlVlO5wzuh0bZkMSMs5NKLMgbTQxmiiWDP9i:3L5qMDYScRNlVlfzuhIromLMKymiZPQp
  • TLSH
    T197B5AF6527F50324F1B74774DEB8483BF82BBC6DD912CB1F24D1314D2A36A629864B2B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorvalleyrat_s2persistenceprivilege_escalationadwareransomwarespyware

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2