General
- Target 316df96201417b9082f872f8f7dc1f366e3b4773b93613f7af2c75086f812af9
- Size 144KB
- Sample260706-wk9nsaex5j
- SHA256 316df96201417b9082f872f8f7dc1f366e3b4773b93613f7af2c75086f812af9
Score
10/10
Malware Config
Targets
-
- Target 316df96201417b9082f872f8f7dc1f366e3b4773b93613f7af2c75086f812af9
- Size 144KB
- SHA256 316df96201417b9082f872f8f7dc1f366e3b4773b93613f7af2c75086f812af9
Score10/10Detects ValleyRAT payload
Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Downloads MZ/PE file
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1