Extracted

• • Target
    Secur32.dll
  • Size 481.2MB
  • SHA256 5c373876a8809d503a329b528f44ec6cbaa2eae834b560be0ea819ce532dc4e6
  • MD5 958ec66aff59d7f4924614ef6bcb4f1b
  • SHA1 5985085db32b8e384a8384b757c4398672d8feb7
  • SHA512 d89de0fc26969fdff832866155b4a5e87ec0f0d1f8468a6e9dfd77646d3ca91ba611a7f049b93366713cac09d695ba5552534648bc588d88baafb453ca45cedd
  • SSDEEP 24576:VPe9kjznfGCtQpbECLy3tb9pHACdiSdI1n50heaKpswOSTouB9Lrxxk9jjrTN0CM:VPe9knL5+50hAOIou7/xxsj/WG1QLtyO
  • TLSH
    T154399D14E3AB11A8D567DA34CA529332D6B078D67721A48F1698CE352F33EF09B7B311
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  • Executes dropped EXE

  behavioral1behavioral2
• • Target
    Tax-Number735863.exe
  • Size 3.9MB
  • SHA256 1fae7d654695f7c4e0f4bb8a42a4c33137652effc360b998708c6ffcac1380e6
  • MD5 bf62f6760a9b86f66822fa59140aef8b
  • SHA1 a71dc7dff873a5341ee93a254fa43e61f85298de
  • SHA512 f47af18705dfd6beec15109c227ca614dd314ce7a5dc4c19b10fc5388d07cd5990e5ea09128235cd88b595eef91a7c0e63e091bf8fc9947479f3d5d8167d9d31
  • SSDEEP 49152:eYqEK9Q8jm5Uzq0LYxjvOPg+BgAiyg8xK90g/u8KwQ61PwST3:lwQD0LYxjvWa3mz8NB3
  • TLSH
    T1A1168C17F68903F9C09AC1749B579162F626BC2A2B3562DF364CB2141F7AEE04B7E311
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryvalleyrat_s2persistenceprivilege_escalationspywarestealer

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Suspicious use of SetThreadContext

  behavioral3
• • Target
    msvcp140.dll
  • Size 540KB
  • SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
  • MD5 4e3fa9bd90ef020c14359639dc19312b
  • SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
  • SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
  • SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
  • TLSH
    T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral4behavioral5
• • Target
    ucrtbase.dll
  • Size 1.3MB
  • SHA256 c2ed69b4a1bb9432c75134e813c70539e27c8c1fe96a784d9be78c874e93d9d5
  • MD5 ef62e9b3d7203f825dbf5dda8d4770c9
  • SHA1 7f1f99f61082c63a645cea72d41481928b4d19cb
  • SHA512 cb79d334af2c436cd62d0f4be8ef8f4f89c4590c666125fd26a218426079beadb9da8cc99cdc28fcef6c3574a4941592f85019aa642f71f1e7559f599b75233c
  • SSDEEP 24576:T9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8Jszg8mxvSZX0ypapJDBL:T9KpUmTfFqSgdDPq3DjqI08JXpJD9
  • TLSH
    T15C55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral6
• • Target
    vcruntime140.dll
  • Size 120KB
  • SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
  • MD5 0d35c5e99871b4f02c490b9fd9dace34
  • SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
  • SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
  • SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
  • TLSH
    T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7behavioral8
• • Target
    vcruntime140_1.dll
  • Size 46KB
  • SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
  • MD5 03b43160d21c08de07a79d0a1c5ee81d
  • SHA1 0a449093006af667432b83303614b53b62fc0d05
  • SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
  • SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
  • TLSH
    T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10behavioral9