Extracted

• • Target
    Open_to_view.exe
  • Size 25KB
  • SHA256 de0b9b6656c9e9fc9db4271610a09c2ae27d07c5a4757e94b2e0314a9dda6ee4
  • MD5 e6363b8ec386338ce08f159a739f0e97
  • SHA1 331e7b016cc9d497463c8519086cf2b9e07c21ed
  • SHA512 aa2998c56f85c70e2bfc02646d67c3cf586b4335226a248845b548be95b4451d6e778d3d79388b411f8a5669ee6af02473c73a808d2b40a4c906c2b9afa81388
  • SSDEEP 384:RpK9Wnrf8uylcxFYQt+hQlP0A1r2VHRN7DDtdQ5R9zC4W9rQ:e9WnIuyCr+AO1ds9z+c
  • TLSH
    T1F6B27C82A39854C2ED6795B0D2B4E253AC39779A0B50D2EF1250E65C0F623C5BE3C72D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistenceransomwaretrojan

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Windows security bypass

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2
• • Target
    winhttp.dll
  • Size 269KB
  • SHA256 384505fd0a9c79969d66fc8380127cbf70187a084bf9210d358120577289926a
  • MD5 7f68b4ec0cbb2edcd93b1c5b048337f0
  • SHA1 32ff6721ce0c8e62618b71dc09402afb23bd4da0
  • SHA512 a70907246bcd2538e57b366af635a0240d9c03a202e2b5481337b08c90d8121c5749107ebefc91d3a9d8435b582299ee40a16186973a12270920e217916b1bfa
  • SSDEEP 6144:kCmyak4JXBlI2sVJABmpYrSedEu09oG+tfTu:k7yak4JXYRoFrSe09o/7
  • TLSH
    T19F4402785E526975FE2680F9C251D26399307C814BB03EE317A0EB3426528E34F75AFB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistenceransomwaretrojan

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Windows security bypass

    defense_evasiontrojan

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4