Extracted

• • Target
    AliyunWrap.dll
  • Size 131KB
  • SHA256 d188594764cfa56c7a1382211f31a982dbda1b1e51792901a29af11f7f93a56e
  • MD5 0044e577a63908034dec43a16fe56fcb
  • SHA1 e67d1ceef7fde0e3f8ae50518afd36388a3a4df7
  • SHA512 4779906186bbfc38e09c641b5735bc5a7f3dc1cfedaa86b98fee16d3b98d1a5e802a5336e862fc50afc7c0d689b6924a9cb205d8b0f5ded3e7ba380d5eb09b66
  • SSDEEP 3072:OlBq9CCO/x0Y3j1WL2xdqTyaZV77sgZN7jK3gjf1:OlUCC+u6Q2xd4BsgHIY1
  • TLSH
    T134D38D5B67B900BBE667CAB8C4974A46A7B5B84207A19FEF0360465D1F273C10E3DF21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  persistenceprivilege_escalation

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Adds Run key to start application

    persistence
  behavioral1behavioral2
• • Target
    AliyunWrap_original.dll
  • Size 570KB
  • SHA256 bc01d5edd77abd191d7e1587da951297b777ba9a35df7742d4e57e30b1d2043e
  • MD5 5cdd61c055e8940a36ad12aac6ac4b0a
  • SHA1 17c36e1bf73e44b335ad17c145760758046405dc
  • SHA512 71fe9c021437a2baadac8e2dd2896e4c8fdfa886a70f97f5dbab053563d22815824327ba1db29d638fc60c3cdc0ef59183021392723fb4b1edd39b0f916c5cd1
  • SSDEEP 6144:nV7NOYjMq+1Hf/QUpatTYzAbhMDw3pGhOTa6hAvpmK+mTtSpQnQ8kSlmpiFtHP5S:nlcYo73QOatphc8E0mwUkSlmsZrJDS7
  • TLSH
    T101C45B8BA7B511E8D4BBC0388553922BF6B2B465137097CB53708B6A1F23BE1673E750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    WebView2Loader.dll
  • Size 132KB
  • SHA256 7227645281302cc4bfea90d5385b5c00ee0f1af9b90315403bc01f38fe879d9d
  • MD5 3468ae4fc7e673de348ba4a87f6d3c1c
  • SHA1 63245d6a7a380c9b2b2c172413c3170d590bef32
  • SHA512 d9d13acd76eda7f909a7506f7f7e9808b712a9f1881c6bcf2048dba3c9ebdd6b50f2ac67e77d6c479c1ac5a6b4d65ef4da95573353756540beb4f38efbbea3b2
  • SSDEEP 3072:fRrcNOeAnnmFJccRmPgsW6cpeLaE2s4Zp+5T7PxTG2g:f91JnnQJccRmYsW6cpeLaE2s4Zp+5T7w
  • TLSH
    T155D38DE41AA8B34E613B99AFF10C077B2EB500C929215F13B4B6738ACE921571FF7255
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    edgestore.dll
  • Size 129KB
  • SHA256 830bc700ab043b4801bae79e7c4b076ea7ae9c0c6298d63f9ad06b3bd6007c75
  • MD5 9cc15853a120e8b984bef3aba27600cc
  • SHA1 2b1a5e1a5cd268525fb37da5dbd2e88c03a41a75
  • SHA512 121b1db0d8294fa7f858aae744322f250a0322d90df97dc1d0bd215a67c56349d85e37569c506e730d7c585976295d37f3bc1ade45eba233d33ad7e54b7e5808
  • SSDEEP 3072:pHh9c452E7dGWqWw2ndY4Dm6AgynKpGzgMPX7jK3gjf1:pB9cexh4r2ndxoqNM/IY1
  • TLSH
    T128D37C5B67B500BBEA678A78C4930947EBB1B84207A59BFF0364425A1F233D15E3DB21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7behavioral8
• • Target
    updater.exe
  • Size 178KB
  • SHA256 c2972fba53e166eb94af5d086b6643fa60632f12bf976fcb25304ce0803d9231
  • MD5 4ef43c6ba61306ebab2f041486bbd3f2
  • SHA1 93367a432581f904604a0cc0e923d3088312525f
  • SHA512 aebec7a2ec7a77ea7a433333f191372f72ed8cc55e83d41b83c1b3caadcf817c86f86cde25bd5a05e54589b07856a0519928bbc9e1be54178651275b90143d10
  • SSDEEP 3072:QD/AJ34i96YqK5qZHQMD4wkRM0tffYERrmvR2bzngAXXVKe9:QNi9JqjHQgjk3tffocgAXXP9
  • TLSH
    T12A044B4BBAA510F9E4BBC1388992651AF672746507319BCF13A0437B5F237E0AD3DB21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorvalleyrat_s2persistenceprivilege_escalation

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Adds Run key to start application

    persistence

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  behavioral10behavioral9