Extracted

• • Target
    2026-08-09_9bdcb2b19f5e10014a3964dbad915fa2_amadey_cobalt-strike_elex_play
  • Size 139KB
  • SHA256 92b768e4b95878a2af4809f6698428b42150d584f30e85c7570711b2c8550e78
  • MD5 9bdcb2b19f5e10014a3964dbad915fa2
  • SHA1 d83946a79814a5b90ba9566473c13caed1233b8c
  • SHA512 aa4ad8dc1d6438128321491aa85668f3439376a46ff425b61431c11bda971c138ed182007a6a6fc9674b2e64c06481e3f38e23ed12b4f8c8062ecfcb49341bad
  • SSDEEP 3072:uGry4HuzTblegqYvZVFFECy4tTP+dEM8QRU9VrbxXSORT:uGrZHY5jFV7eqjxHpbxXSyT
  • TLSH
    T199D35B01F9D28476D6290C308461DA658F3FFCA6CFA099DB77D83DE90D34AD0973AA16
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistence

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  behavioral1behavioral2