Extracted

• • Target
    Tax-Number715863.exe
  • Size 24KB
  • SHA256 295fc291d10a5c7319be945c93b2c1d2761e0ab0701f22457a9e1d860e1893c0
  • MD5 4d6e58a7c46caea0f42bdb07fd1ef75a
  • SHA1 7491324eb2638d70da968fbe6b4462fa183fe055
  • SHA512 791fd7e64199814a85ced73117921ed0cc79cd8f8967a02d3a3916c3153412d3570461d2681f0ec104cea11bc1e481217da9c8f2d03290d722644d68ee1bfae8
  • SSDEEP 384:8WrlxyFLfu5Asx9F7hZFoy8RbmL4nNy6SYo:kFDu5BtZ+5ALAo
  • TLSH
    T176B27D57DEA00CCAFE1B8AB4A0E95626ED71B2959ED183C71379C0090F913817BDA3D9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryvalleyrat_s2persistenceadwareransomwarespyware

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Adds Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    jli.dll
  • Size 198.1MB
  • SHA256 24ef80e0363f8c0c19b5129e25f43aa403e22afb339f3f19d6515ec1ab785d2b
  • MD5 6826705d895d90fb70fc4de4f46a4c34
  • SHA1 fb31d008adf414d12c93813ece4da1b18c994511
  • SHA512 f52052d59643abc1ad424f805023da33dd40cc7a60b6e66cc2be912060fa47e3ab2a7e7531425b3f6bfa2a7058fa9d734f36829a4b8b3650c1ee95612033346d
  • SSDEEP 98304:09F7LG11sYxho7N75XWN0RgiilURUZ81SyfBKWqnh:0L764Yxh6rxgiilUE81bsnh
  • TLSH
    T10DA8BF5EB3C8E5E9D016D9359711A232C2B37BE24F76ACCB1A96C3050E76E915F3A700
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4
• • Target
    msvcp140.dll
  • Size 540KB
  • SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
  • MD5 4e3fa9bd90ef020c14359639dc19312b
  • SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
  • SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
  • SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
  • TLSH
    T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    ucrtbase.dll
  • Size 1.3MB
  • SHA256 c2ed69b4a1bb9432c75134e813c70539e27c8c1fe96a784d9be78c874e93d9d5
  • MD5 ef62e9b3d7203f825dbf5dda8d4770c9
  • SHA1 7f1f99f61082c63a645cea72d41481928b4d19cb
  • SHA512 cb79d334af2c436cd62d0f4be8ef8f4f89c4590c666125fd26a218426079beadb9da8cc99cdc28fcef6c3574a4941592f85019aa642f71f1e7559f599b75233c
  • SSDEEP 24576:T9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8Jszg8mxvSZX0ypapJDBL:T9KpUmTfFqSgdDPq3DjqI08JXpJD9
  • TLSH
    T15C55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7
• • Target
    vcruntime140.dll
  • Size 120KB
  • SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
  • MD5 0d35c5e99871b4f02c490b9fd9dace34
  • SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
  • SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
  • SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
  • TLSH
    T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral8behavioral9
• • Target
    vcruntime140_1.dll
  • Size 46KB
  • SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
  • MD5 03b43160d21c08de07a79d0a1c5ee81d
  • SHA1 0a449093006af667432b83303614b53b62fc0d05
  • SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
  • SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
  • TLSH
    T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10behavioral11