Extracted

• • Target
    2026-08-09_0139a08c36d61c473b22f5da333cffda_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
  • Size 3.9MB
  • SHA256 3dcb2d87765159534b187b9a2fe8fff6412b184304aa8c154ab093a934e02a11
  • MD5 0139a08c36d61c473b22f5da333cffda
  • SHA1 61dd7cf334930067293618226b102906b741240b
  • SHA512 0c54a01fd3c81c4a02d5cf27a175c599806b8c8318c4d8dd7d706fe6c9bbe20662958d2e27d1659a5acf3e2e3a66ab953bec81fceb83002564569e0f66eac98d
  • SSDEEP 12288:ki8rIlAL3dFOZHEN4GSxvST+uNzUzv3IgNaSWYdU4881GNT0Qkb3NnX+ScsTLTX8:kijSw7GSxv70soEBsrbKfKnlfV
  • TLSH
    T15216AD24BDBA812DD027FFB83DECF59EE9EB66191506646B001703478626AC0CF4B5BD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorcredential_accessdefense_evasiondiscoveryevasionexecutionvalleyrat_s2persistenceransomwaretrojan

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Server Software Component: Terminal Services DLL

    persistence

  • Boot or Logon Autostart Execution: LSASS Driver

    Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

    persistencecredential_access

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2