Extracted

• • Target
    QQ私人星星923882186直登器A.exe
  • Size 4.9MB
  • SHA256 dd84fd4a8913ced75711d73706405eb3516118ae1e699dfadca879c186d1d747
  • MD5 457f18ee4c1d8648d3c02d70a64b0c0c
  • SHA1 c8eb036597f670d3e2fdc085bf253fb6275a0a31
  • SHA512 4e5c9acf1216e014a2c6cc4f5bda422f3f77d52b37f2f95fea894f14ee8555d342e9f6fa2673f6654322c2d771b82b7f696e6c0f4903821a8e4e0b37975f8661
  • SSDEEP 98304:R5OSyRSt99rH4SbMXemYZ7AixuJLB69ShNM87X/gL7kBO5WIw0XDR6Pkt+:LgOrH3bMX/YZsiUBzj7XI3kG9t6Pkt+
  • TLSH
    T19836123BF18B653EE06A1A367A72E210943BBA20A5164C0696ECF48CCF755711D3F787
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionvalleyrat_s2installerpersistence

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2