Extracted

• • Target
    Call for volunteers.lnk
  • Size 6KB
  • SHA256 fa163d8e34b5dc22074514bcf8b5cdc91ae6e03a5d99cda681124f750b5aeb81
  • MD5 2ab11bea84ef02aeb95498bbf66ebfd6
  • SHA1 83ec529734386a96105f1e4a1fef329417277096
  • SHA512 ac1d36dcf6bf998a47e248e6235c9fc367823a63e2bebc32ea0d1b508e9fb3af6ba8906f50e8b53223262af05fdf10a3647808c00defb32419de6bf839f8ffb9
  • SSDEEP 192:8gfrWS4QPJ6lSZSWlPJ6QPA+PJLPJN0Nym/u9UaWgLAgV:lfiSXPJ6lSZSWlPJ6QPA+PJLPJN00mq9
  • TLSH
    T1A7E1C3102DEB60C8F1B75B702BC8F9F70A96E4B5692E72F421419B488771AC4DCA3E75
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionbackdoordiscoveryvalleyrat_s2persistence

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Looks for VMWare Tools registry key

    defense_evasion

  • Looks for VMWare services registry key.

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1behavioral2