Extracted

• • Target
    2026-08-04_238dbfd03cb04d850fbcfdfd6d707c20_amadey_elex_luca-stealer_njrat_play
  • Size 11.3MB
  • SHA256 22b35793ae1eb22f99564eb5c41b8f77309c29c63e723e746f5e495700576199
  • MD5 238dbfd03cb04d850fbcfdfd6d707c20
  • SHA1 e75aef8cf258b7a095896c992e538e36a04f84bb
  • SHA512 af085dacd87b2a97d6124119b6a7eaeb1028945f96669ca61be5bc28facd280f3d4877f23f70556e2de5e119d514d998903cf3024a38c2969ade60c6234c3977
  • SSDEEP 98304:z9ihzzLZpooNT6c/iGChGs3pbG3jdsg4gOR/1XhDkF3O3sKCuDjGe54Fi:5s/unKB+xRNxe3O3NW8Si
  • TLSH
    T167C6CF026E0717A8DC9EB6FC702C052500E9AC5F8FA849EA1FE7CD58D72E2A55061F5F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryevasionvalleyrat_s2persistenceprivilege_escalationtrojan

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Modifies Windows Defender DisableAntiSpyware settings

    evasiontrojan

  • UAC bypass

    defense_evasiontrojan

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2