Extracted

• • Target
    2026-08-03_6add3d27fb28b90910ca8a6b25fccf71_amadey_cryptbot_elex_luca-stealer_lynx_njrat
  • Size 104.9MB
  • SHA256 0c9ab72d252930a8129322731682073415f3502451ff87b583fba358d8d84ad9
  • MD5 6add3d27fb28b90910ca8a6b25fccf71
  • SHA1 4c472b9cbd9b359e2d7d9ffebec0acbf4d457419
  • SHA512 08c51e038d56a1fbe1be57fa936fe8e2072b1954ab59d46db8f0efec9e84df7fc4e133370e94b02220f77e0201d3b82ff502352905591107e82a9fe65c1d79f3
  • SSDEEP 3145728:uhUCyu4n18US43YoBDJPup5cqTBZWSCSBthCU:uhUH1+4zAcq1ZrCSBthCU
  • TLSH
    T1CA38335809C9F57EF8C43BB9299C56908046CCB27BE0E89A57EA3F74AB34C5344D4BB4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorcredential_accessdefense_evasiondiscoveryevasionexecutionvalleyrat_s2persistenceprivilege_escalationransomwaretrojan

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • Modifies firewall policy service

    defense_evasion

  • Modifies security service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Disables use of System Restore points

    defense_evasion

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    defense_evasion

  • Server Software Component: Terminal Services DLL

    persistence

  • Boot or Logon Autostart Execution: LSASS Driver

    Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

    persistencecredential_access

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2