Extracted

• • Target
    20260817885699752.930280FCAE.exe
  • Size 718KB
  • SHA256 765d34b234970be7eb12351051eff45d5d9cab515da07e4615381eacdc672d3b
  • MD5 049cee7d33b42c9f21addd23c648927a
  • SHA1 5d7c33d4e8bf9f2332d3e299e5c0a95ca36c67b1
  • SHA512 f6bc235c22ae1a5133b1d3a80811bd2864cb7abd89f00ab22f70616a4665ab032e37c7f4301f23aa56ea369ee5c66ef7b7382ed1ae07cc0ab0625a2323a82930
  • SSDEEP 6144:giTiBkuIgwvp3IRWFr9OgO9nlN9swfsNs0Cc0oGlntzlp0IE:gtv4IRWd9OpLUa+Q530IE
  • TLSH
    T166F4DA5A3B78C1D4E1B7E53D467AC989E67228014B21EACF5058432E1F37BE94E7E360
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryexecutionvalleyrat_s2persistence

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2
• • Target
    libcef.dll
  • Size 1.8MB
  • SHA256 adb5543ddf1aba8bbe1f552a65b084a93630c2d39a5429aa9afa7918293edaa8
  • MD5 cf592b50208b7ef57cbb853ae24d781d
  • SHA1 43c901622e393810e45a6b16a3537f0e896ee8bb
  • SHA512 8fbf5f1360abae36efe6fc9db193f542f056c000a8a1c50c2d4422247de884f095f74d0b218f09532854f35607455d624fe04017c0f26af78d209557db9e03d2
  • SSDEEP 12288:ByY3F0kXQJkaQq5jfnLHQlN5YVBQho8wRUIO8e/uCOgxrsFTIxI1Kq7EIoNL0Ehd:YYCkXQSqtVh1U
  • TLSH
    T1DD9578247DBAC12DC023FB782DEDF4AFE6A9271A1589787B004903174B6DB918B4717E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    msvcp140.dll
  • Size 572KB
  • SHA256 b5400f8454276f1adf944d8ba393866ca423603254baf88bca7dc4c1cf762116
  • MD5 cdf7a0cc26ed6b4136ce69b74d8694ed
  • SHA1 9d7775e53b051a150bd461b0cacebd206bf875dc
  • SHA512 deb4397ad18f0267463ac69e629788f5b9c90265ffb69d1f2c360534b6df7c2a0da3c389916430f3a4675ad8ba29c6c6c95dafee07480bfe74fa913934677abd
  • SSDEEP 12288:49zqgpPAgLqMpP85TAfvULhNaYv0nJxgQEKZm+jWodEEVht4y:44wPrALhAYvogQEKZm+jWodEE7P
  • TLSH
    T1C9C41923B74905E0E195E3B891878706D7F1BC4A8312A3C792EBD69D2F673D1673B290
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    vcruntime140.dll
  • Size 127KB
  • SHA256 98aea63f7c88d733504c08b165fd68a917e256f2cfaeaa742323ef6dddbbce29
  • MD5 d59f36ddcc7460bf5bcd9fde274982bb
  • SHA1 062ed05bfabfabe77d63cfa991f8471475aaf776
  • SHA512 2dd1da4d55ff8a8e2f8528d3c3afd0af31eea5d049fa9dacebac0f194d9a8c265f10426585b734126a3cafe853e7807279ce39e27d95df314c8c9acbe7d1f079
  • SSDEEP 1536:s9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaE/nzR64zESqY:sEnsvReGsWyxLizXFkecbd1aIn34wT
  • TLSH
    T1BED39D85B2A402B7D16AC174C2E3AE17FB75B94487A0A3CF03B59A650F53BE09E3C355
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7behavioral8
• • Target
    vcruntime140_1.dll
  • Size 58KB
  • SHA256 1a1ca015a830a357ad5ec882845d732a60368b6c0d8247a009140cd518377f73
  • MD5 0bdae05fc660c889f1a3a6fd0d7ca3e4
  • SHA1 48572d0da1d1b576f8d9bee7079b2e73edd1f23a
  • SHA512 84d3ca24b54fc50c86e497e9853b4e0c49f65f04b09879af250471b4416a025dfd4bf393b32e494329c2d05817a811bd3c69d80e0d3dae86d567ca73c85c096b
  • SSDEEP 768:UzzO6ujT3MbR3v0Cz6Sz5q83ywPg1HfV9zxfkbK9zqaQ9zoQ:hq/oMx3hsHfnzxfkizqBzoQ
  • TLSH
    T116436CA457784082D99B98B0C1EAEE537D7CB7D60B10924B0BE5E5481F633D1EB3D22E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10behavioral9