Extracted

• • Target
    ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1
  • Size 3.8MB
  • SHA256 ab42f05f3ed9b27d2d84482d6720886a110a885ecc521e9bb67d0f72fe4b7ab1
  • MD5 85143917eaa42805d666a2e56cfbd8c2
  • SHA1 ff53fa6fb7ee5b59f49817ba6f5fe80c98b5090c
  • SHA512 ecf475c3879d702b3e0221defabdc8f1c6e51336395e71004f08b8ae668328c39dc684dbe7b47d2efd7c65c154ac833a28d9eaa3553ee293178b082300ecbc05
  • SSDEEP 24576:9zSNEWT0gd3PZj3mj1P4BRcUEaOhvXIDMWle5:9zSNEWT0AP1321P4rcU9OXIoW4
  • TLSH
    T1FA16AD24BDBA811DD027FFB83DECF99EE9EB66191506646B001703478626AC0CF4B5BD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorcredential_accessdefense_evasionevasionexecutionvalleyrat_s2persistenceransomwaretrojan

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Modifies Windows Defender Real-time Protection settings

    defense_evasiontrojan

  • Modifies Windows Defender TamperProtection settings

    evasiontrojan

  • Modifies Windows Defender notification settings

    defense_evasiontrojan

  • Modifies firewall policy service

    defense_evasion

  • UAC bypass

    defense_evasiontrojan

  • Windows security bypass

    defense_evasiontrojan

  • Server Software Component: Terminal Services DLL

    persistence

  • Boot or Logon Autostart Execution: LSASS Driver

    Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.

    persistencecredential_access

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    defense_evasiontrojan

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2