Extracted

• • Target
    2026-08-08_fd97ea4b8cfbe711cdeff06d6e8c502f_cobalt-strike_icedid_njrat_satacom_stealc_vidar
  • Size 3.2MB
  • SHA256 690b3aacb438e50788ca6018d18caa7bd1d18121e71649e7d2e36067919ca0d6
  • MD5 fd97ea4b8cfbe711cdeff06d6e8c502f
  • SHA1 e4dc5c08c21d06255cab4b527b36a4a3c834028d
  • SHA512 716841fc6bee4c919c6ac43f161eb2dc26059572bf4c57e30f3ae6424e21e8dceadabdde0b2677f97f2dcd8eef75d0804a3cb83f699053c6e2cb89be7460a969
  • SSDEEP 12288:VAwD8FiThnt1gpsWzob3OPvqaNzUzv3IgNaSWYdU4881GNT0Qkb3NnX+ScsTLTXF:VAwqgLXb3OaL/kA9sNF0lPL
  • TLSH
    T1D2F5CD20BDBA811DD067FEB83DECF99FE9EB66191506646B001703478666AC0CF4B1BD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorcredential_accessdefense_evasiondiscoveryevasionexecutionvalleyrat_s2persistenceransomwaretrojanupx

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Server Software Component: Terminal Services DLL

    persistence

  • Boot or Logon Autostart Execution: LSASS Driver

    Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

    persistencecredential_access

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2