Extracted

• • Target
    2026-08-20_9511feb3d1423a533aa1050a313f58e0_cobalt-strike_icedid_luca-stealer_njrat_satacom_stealc_vidar
  • Size 1.3MB
  • SHA256 f0a509e993ff9b65141f77d2892498f6ba9cfbfe61f90e505f2e1ea3074fd823
  • MD5 9511feb3d1423a533aa1050a313f58e0
  • SHA1 f3aa17b90850942507e2aaab9e575ace5b66c97c
  • SHA512 05f4e6cbe6f48c1d468acd1c6671a9810cc6e54d120a6955f9ee0783c8030d902c23af5c9aab86ecde4bfacb575a5d0bd039c15916549af27f92feb34171691d
  • SSDEEP 12288:AeK9vo5ltGUB5c9e9xZrsG8c7WCeSH7SMX5CVC9ZjN1NkbBv+HTgeRKWSXkDh+oB:AB9voEmke9xK4NDNLn4701pk0LdYqmq
  • TLSH
    T1B2653A24B9BA806CD063F7785DEEF45EEAB67A060684B56F014513174F2ABD08F1723E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoorvalleyrat_s2persistenceransomware

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

  • Detects executables embedding registry key / value combination indicative of disabling Windows Defen

  • Server Software Component: Terminal Services DLL

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2