Extracted

• • Target
    2026-08-07_23da772d2679b89e23bad67247c28b4b_cobalt-strike_glassworm_icedid_njrat_satacom_stealc_vidar
  • Size 1.1MB
  • SHA256 68d92f3e92a41614297a82eec91dbf693664798e221eb9ec60a248b7682efed3
  • MD5 23da772d2679b89e23bad67247c28b4b
  • SHA1 1ce0d58fcfefd30ec9006c70ecfe421c618a5d70
  • SHA512 8e8281bd32a9ac9a147f70fdd3e1e195d6fe584256dd0afc7c4d8c085ae29eab781e2bd52c674041180e02199e5a967f9fca10e73a4363bd4eeec1b07866e4ba
  • SSDEEP 12288:y+aohPSmKiyhZ5rAEHUxGZZqHXxvrCNzUzv3IgNaSWYdU4881GNT0Qkb3NnX+Siv:3aePSmVIsKw3lsNiN8Q5kEGCmmGv
  • TLSH
    T14D356D14A9BA41B9E037FF743DDCA899DDEB3E111605A4571251038B8A23ED0DF2BA3D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorcredential_accessdefense_evasiondiscoveryevasionexecutionvalleyrat_s2persistenceprivilege_escalationransomwaretrojanupx

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • Modifies firewall policy service

    defense_evasion

  • Modifies security service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Disables use of System Restore points

    defense_evasion

  • Drops file in Drivers directory

  • Modifies Windows Firewall

    defense_evasion

  • Server Software Component: Terminal Services DLL

    persistence

  • Boot or Logon Autostart Execution: LSASS Driver

    Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

    persistencecredential_access

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2