Extracted

• • Target
    18082026_0344_10082026_20260810124517.A8F39C2D71BE.img
  • Size 3.0MB
  • SHA256 8149cdb27264b5ffb30d4796c97e7fba67cc13b9f53ecf5410abfcfe298e353b
  • MD5 c29ca084bd55057593c286842cb95590
  • SHA1 29766f77eefdf068deed3d9103fc0e3cfd5cffef
  • SHA512 8931822637e8cfa1ca1f40367f84c502fdee0334f68660ffc3cef3f881c6848492e7de76d27b6b06e87b0caec650f38b827f2476c80d818eb81738626a89e59a
  • SSDEEP 24576:+tv4IRWdu4ar7/DY+Rqhsgqa4wPrALhAYvogQEKZm+jWodEE77i:+tv3zT7fqzrALVvtO
  • TLSH
    T1BAE5A4257EBA8128D023F7781DDEE55FE6B936090745B5EB0049031B4F2EBE08B6B179
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryexecutionvalleyrat_s2persistence

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2