Extracted

• • Target
    156d3ec934d09e4b938db205c03392cdac85c9fe9d6181846615cb29fdc79268
  • Size 5.8MB
  • SHA256 156d3ec934d09e4b938db205c03392cdac85c9fe9d6181846615cb29fdc79268
  • MD5 401e8aff5e8923f7839b813e53e10ded
  • SHA1 72c2081dbe1ef051d20fd13af82d88b4b3dc9dd6
  • SHA512 4eef74be6b1ed81631849be23b3251cdc47f9fad328aa24b95c6b72120a1805bda6666647ea6fffd6336c4b2ecd3027b95c3e15683829f76b19eaed0aa0c9a18
  • SSDEEP 98304:pRuvV86IyxYmi7KNB8hIczI0sQrQZrWOcLYeOs04t0uAXr95X5/Gg5s:pR5gxYmrAUrWOcL9xbtH+z5/G/
  • TLSH
    T11856330077C2D037E89710345D7ADB6A96BDAC660F62D6D783F57E56AA302C083367A3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorcredential_accessdefense_evasiondiscoveryevasionexecutionvalleyrat_s2persistenceprivilege_escalationransomwaretrojanupx

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • Modifies firewall policy service

    defense_evasion

  • Modifies security service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Disables use of System Restore points

    defense_evasion

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    defense_evasion

  • Server Software Component: Terminal Services DLL

    persistence

  • Boot or Logon Autostart Execution: LSASS Driver

    Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

    persistencecredential_access

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2