Extracted

• • Target
    a42df8053e42a3f98ce47aa8a0d130c0aa939d3dd9a8585011ddd665a8463fe0.exe
  • Size 3.6MB
  • SHA256 a42df8053e42a3f98ce47aa8a0d130c0aa939d3dd9a8585011ddd665a8463fe0
  • MD5 4d56b55b133743418061a05b4c09cb74
  • SHA1 a5833eec48932d697f0cdc1780e4010667513f0d
  • SHA512 6022e062abc698232b77f7c3146c9509a661db68c8e4b089002919db041cd2776f841f43a93807e8123234d4ef2adac621917fecc7c35885827a0ac27965294c
  • SSDEEP 12288:dhREHV6oG9qxwOmSt2VHfg5QPNzUzv3IgNaSWYdU4881GNT0Qkb3NnX+ScsTLTX9:dhCkat2VHaUewNLrvq1jDwbjfFN7Q66
  • TLSH
    T1A3069B24BDBA812DD027FFB83DECF99EE9DB66191506646B001703478626AC0CF4B5BD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorcredential_accessdefense_evasiondiscoveryevasionexecutionvalleyrat_s2persistencetrojan

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Server Software Component: Terminal Services DLL

    persistence

  • Boot or Logon Autostart Execution: LSASS Driver

    Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

    persistencecredential_access

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2