Extracted

• • Target
    Open_to_view.exe
  • Size 25KB
  • SHA256 de0b9b6656c9e9fc9db4271610a09c2ae27d07c5a4757e94b2e0314a9dda6ee4
  • MD5 e6363b8ec386338ce08f159a739f0e97
  • SHA1 331e7b016cc9d497463c8519086cf2b9e07c21ed
  • SHA512 aa2998c56f85c70e2bfc02646d67c3cf586b4335226a248845b548be95b4451d6e778d3d79388b411f8a5669ee6af02473c73a808d2b40a4c906c2b9afa81388
  • SSDEEP 384:RpK9Wnrf8uylcxFYQt+hQlP0A1r2VHRN7DDtdQ5R9zC4W9rQ:e9WnIuyCr+AO1ds9z+c
  • TLSH
    T1F6B27C82A39854C2ED6795B0D2B4E253AC39779A0B50D2EF1250E65C0F623C5BE3C72D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistenceransomwaretrojan

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Windows security bypass

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2
• • Target
    winhttp.dll
  • Size 378KB
  • SHA256 c4b4205228f54be2422d69f9d7575c69d85a6ef0775118f6ac18eaf77e4b623c
  • MD5 a7b17ab646bbb624ec3ad12209e1b596
  • SHA1 7075f715714f5cdf609957b11195e73d39cc1ab6
  • SHA512 f36687dab32f563dc8f438db8c870972cc6f59a309504fd57dcc20ee4ca35a8a6ed36e13634fdc88de217997d90a1f3b88351595ec7f55482507aa3355246a0d
  • SSDEEP 6144:NMlT6wypodssz+UIilHukhWxxh72k8SD1amR6fN9pn0s9M6FEbu0ge:No6wy62szLICu7iL+wmAfLtxxGbu0ge
  • TLSH
    T18684E1465B4514F8F32B8679C71E155AA0AFA0EC4F5CEDEA80C1CB4C2E934C272F69E5
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistenceransomwaretrojan

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Windows security bypass

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4