Extracted

• • Target
    3a0ee05966e9cf4bf33ed736a8e519ee121a2d79b493f5206c9023804ef840f4
  • Size 4.6MB
  • SHA256 3a0ee05966e9cf4bf33ed736a8e519ee121a2d79b493f5206c9023804ef840f4
  • MD5 6f3482041a81b303fc8dc78b1ecd53c4
  • SHA1 39b75e3ff4117ab2c755409130decd4970131356
  • SHA512 b0d98237204b7a2c8f8d5d913565c4e5c5bbfd6841030595669d44c7ef45f4998e9a306c8e751c10d4fb1c1d2030bc1456f462d5f3318e51bfebf204312cb1ff
  • SSDEEP 98304:R5OCyRSt99rHpcnenafXHWO/FsCmEQbD6IfwX/gL7kBO5WIw0XDR6Pktn:LwOrHpcKW3WuePEQXtoXI3kG9t6Pktn
  • TLSH
    T1EB26023FF28BA53EE02A5A367A72E210543B7A6065024C4696ECF48CCF255711E3F797
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionvalleyrat_s2installerpersistence

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion
  behavioral1behavioral2