Extracted

• • Target
    1.exe
  • Size 76KB
  • SHA256 b50952f9af310be586746356508b9fd430dcbbaa155a04e6f9563632de0a023b
  • MD5 2b99efa18ca9132208a73c7888a8f518
  • SHA1 dea37c5984985da472dda61d3b6a4cce462ae6b9
  • SHA512 42c71c058c7ffebb4f6d2e3c8725eae6653dff50d55648576057ee7ead645db76b747cc67d3e864abb4b314f849821f589cc1adbc4db7553e513e672684bb6c4
  • SSDEEP 768:UBB1AKdpLnrhi+NwjGNNKgZ8bmY5/hQ9E08N6QNdA3iPmbL:Uz5hi+NwjGNNKpT55YE08NZTu7
  • TLSH
    T1EE7397C2E382AE4DEF0E70771763856480B9A9B25F036403B70D729E39F9DA0174D5AB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    2.exe
  • Size 76KB
  • SHA256 b50952f9af310be586746356508b9fd430dcbbaa155a04e6f9563632de0a023b
  • MD5 2b99efa18ca9132208a73c7888a8f518
  • SHA1 dea37c5984985da472dda61d3b6a4cce462ae6b9
  • SHA512 42c71c058c7ffebb4f6d2e3c8725eae6653dff50d55648576057ee7ead645db76b747cc67d3e864abb4b314f849821f589cc1adbc4db7553e513e672684bb6c4
  • SSDEEP 768:UBB1AKdpLnrhi+NwjGNNKgZ8bmY5/hQ9E08N6QNdA3iPmbL:Uz5hi+NwjGNNKpT55YE08NZTu7
  • TLSH
    T1EE7397C2E382AE4DEF0E70771763856480B9A9B25F036403B70D729E39F9DA0174D5AB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    3 (2).exe
  • Size 76KB
  • SHA256 b50952f9af310be586746356508b9fd430dcbbaa155a04e6f9563632de0a023b
  • MD5 2b99efa18ca9132208a73c7888a8f518
  • SHA1 dea37c5984985da472dda61d3b6a4cce462ae6b9
  • SHA512 42c71c058c7ffebb4f6d2e3c8725eae6653dff50d55648576057ee7ead645db76b747cc67d3e864abb4b314f849821f589cc1adbc4db7553e513e672684bb6c4
  • SSDEEP 768:UBB1AKdpLnrhi+NwjGNNKgZ8bmY5/hQ9E08N6QNdA3iPmbL:Uz5hi+NwjGNNKpT55YE08NZTu7
  • TLSH
    T1EE7397C2E382AE4DEF0E70771763856480B9A9B25F036403B70D729E39F9DA0174D5AB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    3.exe
  • Size 76KB
  • SHA256 b50952f9af310be586746356508b9fd430dcbbaa155a04e6f9563632de0a023b
  • MD5 2b99efa18ca9132208a73c7888a8f518
  • SHA1 dea37c5984985da472dda61d3b6a4cce462ae6b9
  • SHA512 42c71c058c7ffebb4f6d2e3c8725eae6653dff50d55648576057ee7ead645db76b747cc67d3e864abb4b314f849821f589cc1adbc4db7553e513e672684bb6c4
  • SSDEEP 768:UBB1AKdpLnrhi+NwjGNNKgZ8bmY5/hQ9E08N6QNdA3iPmbL:Uz5hi+NwjGNNKpT55YE08NZTu7
  • TLSH
    T1EE7397C2E382AE4DEF0E70771763856480B9A9B25F036403B70D729E39F9DA0174D5AB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7behavioral8
• • Target
    3.pdf
  • Size 824KB
  • SHA256 a6dde2021305f44bf707b879375811aac356af8d966329cb129df4de2fd0058d
  • MD5 6f920edeba4dcb13663936d38eac6148
  • SHA1 70b18ae658c5fc3b3f52ee72cc9a73fbe5b37ec4
  • SHA512 580ac9068dc9ab155a6c2f9c49a0935f2c915a81860ac9ccafe91fa53f1d698b9098cfe379ca5f5361044fd8146c5da3dc7a665dacd257c3fad05920e42a2a46
  • SSDEEP 24576:l0UtBd5co4vi7sMdnFxG+h/99MMwUjtFOkM9jRKfGW:l0wd2o77bde0/rMMwQGV9jofGW
  • TLSH
    T13C05F1B9E9D41CDCEC43CB8665A6391445ADF14B97CC3AC118BC8F86B181F0E9B935E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral10behavioral9
• • Target
    4.pdf
  • Size 824KB
  • SHA256 a6dde2021305f44bf707b879375811aac356af8d966329cb129df4de2fd0058d
  • MD5 6f920edeba4dcb13663936d38eac6148
  • SHA1 70b18ae658c5fc3b3f52ee72cc9a73fbe5b37ec4
  • SHA512 580ac9068dc9ab155a6c2f9c49a0935f2c915a81860ac9ccafe91fa53f1d698b9098cfe379ca5f5361044fd8146c5da3dc7a665dacd257c3fad05920e42a2a46
  • SSDEEP 24576:l0UtBd5co4vi7sMdnFxG+h/99MMwUjtFOkM9jRKfGW:l0wd2o77bde0/rMMwQGV9jofGW
  • TLSH
    T13C05F1B9E9D41CDCEC43CB8665A6391445ADF14B97CC3AC118BC8F86B181F0E9B935E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral11behavioral12
• • Target
    HH.pdf
  • Size 824KB
  • SHA256 a6dde2021305f44bf707b879375811aac356af8d966329cb129df4de2fd0058d
  • MD5 6f920edeba4dcb13663936d38eac6148
  • SHA1 70b18ae658c5fc3b3f52ee72cc9a73fbe5b37ec4
  • SHA512 580ac9068dc9ab155a6c2f9c49a0935f2c915a81860ac9ccafe91fa53f1d698b9098cfe379ca5f5361044fd8146c5da3dc7a665dacd257c3fad05920e42a2a46
  • SSDEEP 24576:l0UtBd5co4vi7sMdnFxG+h/99MMwUjtFOkM9jRKfGW:l0wd2o77bde0/rMMwQGV9jofGW
  • TLSH
    T13C05F1B9E9D41CDCEC43CB8665A6391445ADF14B97CC3AC118BC8F86B181F0E9B935E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral13behavioral14
• • Target
    LoggerCollector.dll
  • Size 221KB
  • SHA256 65773d8a11bb0e816722e7fbfaee27641ce09e3f7b9ebb9e5a9b61cc698f5a1e
  • MD5 e496ece791410fa6a875834e563af618
  • SHA1 91fab8c18b935fa855d5eed1ab36a6bf4aa0fb5b
  • SHA512 8cbbf3cf37eb63cd1c94051ee6ac26ef5536a74755899f63a59497415507b845b6b266851e673232dff689a3ca60af32db00bc5c74de7db6b4434e8425a8d660
  • SSDEEP 6144:1dEc30obt03VNK1MJNZlJBBcFfr+gVG4p8pXi:1yiCFNKuBcpr+A
  • TLSH
    T1A1247E01B5D2C076D9BE09308979CF655A7EF8A04FB0E9CBA7C44DEE4E316C09735A1A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral15behavioral16
• • Target
    MyProg-x64.exe
  • Size 76KB
  • SHA256 b50952f9af310be586746356508b9fd430dcbbaa155a04e6f9563632de0a023b
  • MD5 2b99efa18ca9132208a73c7888a8f518
  • SHA1 dea37c5984985da472dda61d3b6a4cce462ae6b9
  • SHA512 42c71c058c7ffebb4f6d2e3c8725eae6653dff50d55648576057ee7ead645db76b747cc67d3e864abb4b314f849821f589cc1adbc4db7553e513e672684bb6c4
  • SSDEEP 768:UBB1AKdpLnrhi+NwjGNNKgZ8bmY5/hQ9E08N6QNdA3iPmbL:Uz5hi+NwjGNNKpT55YE08NZTu7
  • TLSH
    T1EE7397C2E382AE4DEF0E70771763856480B9A9B25F036403B70D729E39F9DA0174D5AB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral17behavioral18
• • Target
    SER.pdf
  • Size 824KB
  • SHA256 a6dde2021305f44bf707b879375811aac356af8d966329cb129df4de2fd0058d
  • MD5 6f920edeba4dcb13663936d38eac6148
  • SHA1 70b18ae658c5fc3b3f52ee72cc9a73fbe5b37ec4
  • SHA512 580ac9068dc9ab155a6c2f9c49a0935f2c915a81860ac9ccafe91fa53f1d698b9098cfe379ca5f5361044fd8146c5da3dc7a665dacd257c3fad05920e42a2a46
  • SSDEEP 24576:l0UtBd5co4vi7sMdnFxG+h/99MMwUjtFOkM9jRKfGW:l0wd2o77bde0/rMMwQGV9jofGW
  • TLSH
    T13C05F1B9E9D41CDCEC43CB8665A6391445ADF14B97CC3AC118BC8F86B181F0E9B935E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral19behavioral20
• • Target
    TT.exe
  • Size 76KB
  • SHA256 b50952f9af310be586746356508b9fd430dcbbaa155a04e6f9563632de0a023b
  • MD5 2b99efa18ca9132208a73c7888a8f518
  • SHA1 dea37c5984985da472dda61d3b6a4cce462ae6b9
  • SHA512 42c71c058c7ffebb4f6d2e3c8725eae6653dff50d55648576057ee7ead645db76b747cc67d3e864abb4b314f849821f589cc1adbc4db7553e513e672684bb6c4
  • SSDEEP 768:UBB1AKdpLnrhi+NwjGNNKgZ8bmY5/hQ9E08N6QNdA3iPmbL:Uz5hi+NwjGNNKpT55YE08NZTu7
  • TLSH
    T1EE7397C2E382AE4DEF0E70771763856480B9A9B25F036403B70D729E39F9DA0174D5AB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral21behavioral22
• • Target
    XIAO.pdf
  • Size 824KB
  • SHA256 a6dde2021305f44bf707b879375811aac356af8d966329cb129df4de2fd0058d
  • MD5 6f920edeba4dcb13663936d38eac6148
  • SHA1 70b18ae658c5fc3b3f52ee72cc9a73fbe5b37ec4
  • SHA512 580ac9068dc9ab155a6c2f9c49a0935f2c915a81860ac9ccafe91fa53f1d698b9098cfe379ca5f5361044fd8146c5da3dc7a665dacd257c3fad05920e42a2a46
  • SSDEEP 24576:l0UtBd5co4vi7sMdnFxG+h/99MMwUjtFOkM9jRKfGW:l0wd2o77bde0/rMMwQGV9jofGW
  • TLSH
    T13C05F1B9E9D41CDCEC43CB8665A6391445ADF14B97CC3AC118BC8F86B181F0E9B935E2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral23behavioral24
• • Target
    chgport.exe
  • Size 2.2MB
  • SHA256 255e4c5b81ddabc02455b7b4560e168b4064e63ec3721230201d1a7928c9f158
  • MD5 33922d12e5bb8f40ecddf816124ae93d
  • SHA1 28244217fa205f12cf40278e97a3a01e6d7366a3
  • SHA512 1fdc906fdf3a89105d8e8996ec58e26e4d802fbbc99004d2f9a13a94cabeabde104fd55135763d5b959d1741d53e06ca18879407864c1e37e0a8764df9ea1973
  • SSDEEP 49152:6r7yiWVow1eV9LFc2/4Pu6qBWzoTJkpuHI27:47PW+2eV9LXmCWzwJS+
  • TLSH
    T1E5B56D21B546E433E5B200B157BF57FEC62DAA30172580CBA3C05EB95A386D37A3176B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryvalleyrat_s2

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral25behavioral26
• • Target
    glib-2.0.dll
  • Size 1.1MB
  • SHA256 2e6ed256cc0c0e1dbd8d0fbd83818744b4723def05be9c0bcbca961feac56fdf
  • MD5 daa7802f04778cb6287490737ad48c50
  • SHA1 115ec90a6b366e469aca8082524f13be14a4c5e0
  • SHA512 d0d697fd12229a90add7a2effb6541425b1e33144ba98ad4b044f4ab12a0b9ad5288c1b42a9a59efe2422e0028ebe4fa6645392c39eb9118e49422cd26793331
  • SSDEEP 24576:wiLoh7Mu3tDbVt1nqxo/GqMMaeE0YZr+NIZd6tv1M80ap:xkh7Mu3tf1nQo/GqJbE0YZrsoktvEC
  • TLSH
    T110452955E64939A7EB96CC7988E19353E27075080F3366DB3E6CC6691B2FAD30236F01
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral27behavioral28
• • Target
    gmodule-2.0.dll
  • Size 131KB
  • SHA256 790f2d9aee17bd3601996eaada618d0e932b424c937c0265a3d81d24ac0d0120
  • MD5 836e62f8b5a9c29611d941ded67f2967
  • SHA1 a67d9cd4191386a1363ed3e846d1fa89d08f8ffb
  • SHA512 c1802d8cd5ae1bcfdd5820de60d5b788ae8fda1f4d8f74fa26d5b8e8835db3ac67070fe5ccd9bf86145a9e73fa3e5ac9ea532279ca82d050d4dead90bbff6bf1
  • SSDEEP 3072:b4PvcnHmArw+oyWAT1gCRLpPwTR57K59ZLwpKkD9:nHmoloy/gCxH5bw4e9
  • TLSH
    T19CD3294B77A510FBE0BBC139C5931A06F7B2B86207609B9F47A0465A1F237E09D3DB61
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral29behavioral30
• • Target
    gobject-2.0.dll
  • Size 295KB
  • SHA256 8716833a789cb1bd0c3367be44996f9198138faaeb876a7874812319ff505c3f
  • MD5 f8ed96def23c414c08b064cc13e6e67c
  • SHA1 ff4aac8d31996cb557f65571f5c76206c156acd4
  • SHA512 ea0d87c4fc5e622560c8ae2416461fa8db40a9c404322ffd24f47d95b1d132df42892afd4a90beb73b29ff1656692f424ea918d13c5127a588e1d321b180e03c
  • SSDEEP 6144:qpFZCqYVAWHgAhh+c12xSk5FbYL+W5nP/fijbRV4KNPGmKHTAZTYWu3TM:uFZCqYqWH3hh+c12JSVinR91KYEY
  • TLSH
    T18B545B5DA2582C69EEABC038C642D507D2B374011362A3CF17B487AA1F37AE5F93E705
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral31behavioral32