Extracted

• • Target
    2026-08-16_89ae6a98f7bed15cadb6e1a49b2f33a7_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
  • Size 1.1MB
  • SHA256 27fc87e21994dd2474fb4465eebdb15bed7e9933fdab6aac150d39d939bbf7d9
  • MD5 89ae6a98f7bed15cadb6e1a49b2f33a7
  • SHA1 d0208287b10a497f34c4b1a2ef38417313fccf2c
  • SHA512 da6af460126e0c91513d684f9d899d5b8c6eec80c8c3076f8ed5686bf3f2b3bb14995d102d91f29b1232d18779f5aa4fd29ad6f5ef9bdd88952facb2b2bfcb4e
  • SSDEEP 12288:1glN5KShrogPt9j6VSj/lj8c7HCeSv7r8dNgt9A1JwxogHNvsKPOV8lxNM59bour:12prj6ghF8qqlxe/cu/Zl
  • TLSH
    T11735F614BABA816CD063F7785DEEF55FEABA7A090644A52F014513170F2ABD08B1733E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorvalleyrat_s2persistenceransomware

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Server Software Component: Terminal Services DLL

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2