Extracted

• • Target
    Statement of Account.exe
  • Size 25KB
  • SHA256 de0b9b6656c9e9fc9db4271610a09c2ae27d07c5a4757e94b2e0314a9dda6ee4
  • MD5 e6363b8ec386338ce08f159a739f0e97
  • SHA1 331e7b016cc9d497463c8519086cf2b9e07c21ed
  • SHA512 aa2998c56f85c70e2bfc02646d67c3cf586b4335226a248845b548be95b4451d6e778d3d79388b411f8a5669ee6af02473c73a808d2b40a4c906c2b9afa81388
  • SSDEEP 384:RpK9Wnrf8uylcxFYQt+hQlP0A1r2VHRN7DDtdQ5R9zC4W9rQ:e9WnIuyCr+AO1ds9z+c
  • TLSH
    T1F6B27C82A39854C2ED6795B0D2B4E253AC39779A0B50D2EF1250E65C0F623C5BE3C72D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryvalleyrat_s2persistenceransomwarespywarestealer

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Looks for VMWare Tools registry key

    defense_evasion

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2
• • Target
    winhttp.dll
  • Size 365KB
  • SHA256 46cb44d3c7badf7717a734494593b52cd217fd2b966d6b95f39b5522d8fb9afa
  • MD5 bc990977e6c15a3ba823c9eda58f8391
  • SHA1 735197fb88a6f0a048d5ccb18440b40b331ca7b6
  • SHA512 e1f08429704e0fc8694992f795f64da3fd3bb8fc83f038b3b0b6d8f2282a6f459278753b6dee956a204d30b4e70e165a2356f2f4696979e1fd5b8190b3a30e4b
  • SSDEEP 6144:2bmj/tj2cynr6Ff39WkeX2Y6+lPVYeAEmDB6BNyzQirKu8QPPwjFRbq:2bEjzynGdNWkyD6YYeOB6BAzxrKu5wji
  • TLSH
    T11E84E0888EC9D467CD918C399A6AA875F671335FC864A0BB03F1E4A40E1EBDFB454D0D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4