Extracted

• • Target
    XunLei12.8.1_x64_exe
  • Size 118.3MB
  • SHA256 e38a77b86f9cead5ce4e3af21c8d6458b567c64e3fc5284161306924dfeb7117
  • MD5 1db2090f78404da4ede41b1d33ee2300
  • SHA1 b327dd570b4e1fcaa73a6071551e6fbecb28ced7
  • SHA512 765ec132d31002b34d332c7c08dae252759058c8c13b5fa70c5856348b86bcee4f6469cb59c48d8b73f191769ce1eacc042509b3a733c0bd7224606b4d693900
  • SSDEEP 3145728:QUfZ0XaAD8EOXey/FdIdgqghrWVr5IQIOpITrq+0rdfu0be4:0KpHIdLaiViOpSr/ufu0X
  • TLSH
    T1294833408D7BA9D6F0A6C3351D7A36CC296C8C69F4BAC3D740487DB29A72B4261CD4B7
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorbootkitdefense_evasiondiscoverydonutloadervalleyrat_s2loaderpersistenceprivilege_escalationransomware

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2