Extracted

• • Target
    OCefClient.dll
  • Size 54KB
  • SHA256 89f1f236a5fbc95e3540626caf9cdfe525bcd85789c4ac95c8b99e1781015a8c
  • MD5 c2129f59f43570484456038599bcf74b
  • SHA1 d3c429775900e927c44c81f52fd080ebede3abb6
  • SHA512 2491792eb74b4f3da10a75ab7cc7644f265f6713e320975b7dfff5001f4e184d1ae1de5ce199e6a18c7738aac20131362d876dc07e3551a6b36e84f21b7725e5
  • SSDEEP 1536:eHnEYEWlugauOXeCkPEbglZoEb7W01s0CpHzTr35rdS55szGCJOAaFVcnseS8E2e:ek9LaPZvM25K2USLMnu
  • TLSH
    T13A430B0AF223FDAACDA191F3999ABDE518E0F4650131D2FAF45F8E74C121518DE9932C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    Please View.exe
  • Size 309KB
  • SHA256 58322e445aa9ae532055b117393e28ff38a114a97f42acd91ba8c1cdaea0ca3a
  • MD5 8a22de7b66ce2c8b583f9eed108c0c4d
  • SHA1 e3e506a509bb3a3fb137a526f651635a89c71168
  • SHA512 f973e7c3fd10026dffeb46dd6a087e5fe7e4e3c562367978d0bf90cbc5eed1c0c2eec5be5cda364645b8a7ae06e1914614b1e9e7cc06cb0047957b503e14c987
  • SSDEEP 6144:O6vv2vvTvTvvYwVrR/M//4ehi38jjjuy6lZ3ce:Nk/M//Ri38jjjuy6T3p
  • TLSH
    T1FD64B5B28812CB67C42954B1EB1BCDF8064A6FBCD14965FB069E7F2374FE201945C8B6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorvalleyrat_s2persistenceprivilege_escalation

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  behavioral3behavioral4