Extracted

• • Target
    2026-07-16_d946a679421569d79e041b2846bbfa2d_amadey_darkgate_elex_glassworm_hijackloader_karagany_luca-stealer_lynx_metamorfo_njrat_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 60.7MB
  • SHA256 5876be168613a5e77024f79dad518662e8fd418f01d5839fc7e73ecb0f085a92
  • MD5 d946a679421569d79e041b2846bbfa2d
  • SHA1 d070665647d554a5e2bb9f00df82ad8f84734ffa
  • SHA512 22bd92c74b9d2cec1702764136c2839cbc4072ff209762f3b4cddea6d9b8617f7255da3b24e774efa5d59f49c89fb8ee6d57aa733672f178b49efc3299dd6695
  • SSDEEP 393216:jyXTTpculw3aURH+EIXBYNitrgaFa1305l/9CidVeJoqaQKiYq7eSdK0ngpk+HcD:cKRErYd7Pt6oW2p5VyzIT8WAHNO
  • TLSH
    T1A5D78C0272A64AA1FDB23B3142D51726EF37BD3157B648973E0C2BF60F7A3254A27611
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryvalleyrat_s2persistenceupx

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • UPX dump on OEP (original entry point)

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2