Extracted

• • Target
    2026-08-04_f7ac13a44e8b7228031235ad58e56423_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
  • Size 2.0MB
  • SHA256 7504810d12072e2516a87cdc321b94554ac93e1c71d45498dd89bd47904723bd
  • MD5 f7ac13a44e8b7228031235ad58e56423
  • SHA1 04ff7e4dbbfa5f615ba721ed4c2794c26cc0b5fe
  • SHA512 2c591f2bbcc4b7aac57bad10f4780c8fdd7469ce1e658f0d67b9432811908f01b6d4a77dafd94c80e6f90f84c23786a4ca8d2133cdfcc1d20aa58f4c5b18b013
  • SSDEEP 24576:43CLE+4CyHy7gewNLrvq1jDwbjfFNKQx:43CLEmyS7HOXvq1jDINK
  • TLSH
    T193A59224B9BA8129D037FFB83EDDF89EEDEB3A151544646B0145034B8A22AD0CF5B53D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorcredential_accessdefense_evasiondiscoveryevasionexecutionvalleyrat_s2persistenceransomwaretrojan

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Server Software Component: Terminal Services DLL

    persistence

  • Boot or Logon Autostart Execution: LSASS Driver

    Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

    persistencecredential_access

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2