Extracted

• • Target
    jiazaiqitest.exe
  • Size 2.2MB
  • SHA256 da869770b9b146ca7dec8b84e2db20eb4944f13c0af247c0f2e141b0448b022c
  • MD5 b7f776084d7b77c5df44c7d3801a533d
  • SHA1 c1a71eb91a4082911e4431e2be5a2313971a12f1
  • SHA512 2b010e7bae2fe36bfb3300e84260184354674c1e163ee25acd24016a848a2c72124ad842b81112a72fc5cce545019e1cdd2d7d36421832f674f6bf9e3d11bea1
  • SSDEEP 49152:OWE+OX4FyGMHbgX4hA/sBzd6FLH0Gz0sk8MLnT0qFMfjuk:O3jWTMH8XAfB6UGz0sk8MUqFMfju
  • TLSH
    T12CB58DA135804077C5F206305FDDFB79F3ADA6380B3941C7E3D09A1DBB624A2962D66B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryexecutiondonutloadervalleyrat_s2loaderpersistenceprivilege_escalation

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2