Extracted

• • Target
    2026-08-07_e53e509f65f87399691895687dff6160_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
  • Size 20.8MB
  • SHA256 c8fd1985e01bb63b47fb890c66aaf8c491c3eb19d39fee3fd16ffaa574bdb390
  • MD5 e53e509f65f87399691895687dff6160
  • SHA1 7774761148be992f275c9f7e716b8460958507ee
  • SHA512 c88410e4b0b33147706cccaefb4527d5baa233a51400f3bc05aafabea23fab8bcdaa5820b9ba6e974f4245c97d69a085ed33e359c770052ce34f477b82b62149
  • SSDEEP 393216:zdSRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRoRRRRRRRRRRRRRRRRRRRRRRRRRg:
  • TLSH
    T18A27F10116A605F0D7C1CDB48A676A97C27E782FAE27925B8316DB673F333C9882571C
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryexecutionvalleyrat_s2

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2