Extracted

• • Target
    Open the latest report on the computer.exe
  • Size 6.2MB
  • SHA256 6466edbbf631738d6863a93d4aad2a42251dffcc2d36b2afdab52491b28dbc57
  • MD5 f2c1eda05cf577edb50f81373bdee7e5
  • SHA1 ba9dff11cd591e7b99bce7a06fbb4188fd7a56c9
  • SHA512 1036ce10807834495221320e324f26c80257fafe10eab35b0122d333e795248c41ef3f8df41000385105819301bf3efad84709d6bd12c04b1a85a831ea7e7b5d
  • SSDEEP 196608:5hFACeu7MOsJ/EEpJrIrQrrrrrrrrHwrrrrrrrrrrrrGrrrrrVrrrrr3d+tr1:5fe2M5/Ebr1
  • TLSH
    T15D66BF12B661C136E5D100F4A57EAFBD597C8F508B2488C3E3C43EDDA9726D22B3671A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryvalleyrat_s2

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2
• • Target
    libcef.dll
  • Size 107KB
  • SHA256 a357b62421a27d083f122087f482b62fe70a2f8b636a3008954044e8f293c867
  • MD5 71f66fad3ed96e2a75667d4bf89cce68
  • SHA1 997b5e8317bc43f538103c2d551bc12b001ed913
  • SHA512 af6f834b6e691acb81633656621cd9b0ef8fc969baca714bfa2e0700ee41f0feaa331859dace2f54ceb48e0766e75211656927971470024f2d980091cd4d296c
  • SSDEEP 1536:unFhe0HRF6pCOLNnLc4x9VsXvD2Qbe4x+eOnZOfDtsWJcdl1d4l3cF47C:z2D6/m4xUvD2QbtUwUlglMOO
  • TLSH
    T163B38C01F9D1C474DA7F19390868DB658F7D7910CEB08CA7272A067E4FB12C1EE35A6A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryvalleyrat_s2

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4