Extracted

• • Target
    2026-08-20_2770f48da6d9506e3799b0f0e73fe1bc_amadey_darkgate_elex_glassworm_hijackloader_karagany_luca-stealer_njrat_poet-rat_redline-stealer_remcos_rhadamanthys_smoke-loader_stealc_stop_tofsee
  • Size 43.0MB
  • SHA256 6054adfeec8ddefc77625ce96233715409686042cf51c1a8b43f3895f2530956
  • MD5 2770f48da6d9506e3799b0f0e73fe1bc
  • SHA1 fc72c9ab042b511812aacf064ec0095868d76c32
  • SHA512 0c932af309d43cbe9a5f75717182aa30c327c1a4fa6e39ab74f4c649539235b929582549be22f5384da53451c6b27c010bed06fc7f0353660c3e4d3576d8b989
  • SSDEEP 786432:2Mt6oW2p5V/bArRi0z/RioXvGR6kOoHB00NaGmaiq3xKASLqEh7jmrMwP5t:pkodhAM0z/9e8lC0zaBwqZ
  • TLSH
    T170A7D0C27182E0B3CB9292F5861EF6BB85FA7D15C71C82C392547E916430FE2DA7B146
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryvalleyrat_s2persistenceupx

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • UPX dump on OEP (original entry point)

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2