Extracted

• • Target
    20260826.547281.6E9A319CD53AFD.exe
  • Size 47KB
  • SHA256 4ba01b04681a5273facdd8b17e7b7b2246ee0eab6168c932946e7e96b9099e2d
  • MD5 0dcc1bacda98269a9f44a8777ea6e272
  • SHA1 0d15da2cda421fa8e08cf3881e807baa841b973c
  • SHA512 1a0ba71c0802892ce55d9b4fffa4165e07c5e8ab55cba6ae2222b00f63ba60c42145b461c58028652fa4f260bad69a257b27d8f7e89e5d0dfeea4292233d6716
  • SSDEEP 768:agR8YITEd6yuorai4FNDs4AeYiDLk54FPQQ83uYijFPQQ15ALIK:78YIbqrN4Fa4Ae7JZ83u7pZtK
  • TLSH
    T151239DA78ED848D1D8178538A8E19522E9B1B2451BA2C3CB2345C21D0FA67C33FFD3D9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryexecutionvalleyrat_s2persistenceupx

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2
• • Target
    core.dll
  • Size 667KB
  • SHA256 17987c47aeab610dec6364c869ab3ab4dac322782a041ff39b3272326b9ddd81
  • MD5 0b11f0e6306454dc56f0c9421011e8a5
  • SHA1 5fa50fb83412566277bf17cf1534edd613e9f9d2
  • SHA512 7eeb80419eb5e3b710524299cd40cba0336ed8bda9e600a91ca99f9029c5fdc177f8f8bbe8af18907a1c312460fe0053a66a48d8ede0694ca2d00a9a8162a1eb
  • SSDEEP 12288:2vZZHpmpBHe9lMV1i5PWs+SApEWHS0K39FGgxRSQnQdGaY6P:5V1McSAGWyV3PtxRS1dGaY6P
  • TLSH
    T12BE45C2B776442EDD16AD2385A979252E7F270090B618BCF0791436A2F27BE16F7F310
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    msvcp140.dll
  • Size 572KB
  • SHA256 b5400f8454276f1adf944d8ba393866ca423603254baf88bca7dc4c1cf762116
  • MD5 cdf7a0cc26ed6b4136ce69b74d8694ed
  • SHA1 9d7775e53b051a150bd461b0cacebd206bf875dc
  • SHA512 deb4397ad18f0267463ac69e629788f5b9c90265ffb69d1f2c360534b6df7c2a0da3c389916430f3a4675ad8ba29c6c6c95dafee07480bfe74fa913934677abd
  • SSDEEP 12288:49zqgpPAgLqMpP85TAfvULhNaYv0nJxgQEKZm+jWodEEVht4y:44wPrALhAYvogQEKZm+jWodEE7P
  • TLSH
    T1C9C41923B74905E0E195E3B891878706D7F1BC4A8312A3C792EBD69D2F673D1673B290
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    resmonitor.dll
  • Size 177KB
  • SHA256 9f185ed99336d159f552d85ac12e276874ef42c8fd4a05eacbe9da3f7b9f0520
  • MD5 8688688ab59154a5c379b01877ed351d
  • SHA1 306aa47690b37f6d86c4b2fb218e3ad321785a61
  • SHA512 fc3d9e92a7f20ad5c429dba0f7f00b9212e772faa3bf0ea1186f15b3c696cefae207c5a003d500d66046c1d78078566757ea9d3cce672ac306da0213b77f0689
  • SSDEEP 3072:mNGXitYlbwBTkmg6zam6kAHFePxmkXrWhz0NHoYF1Z91ZfYJ:mXYRgbg6zR6jFePxmSrWhz0NIaYJ
  • TLSH
    T14C04396B779450AAC52BE278DAA78642F7B274151B7187CB0360437E1F37BD06E7A320
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7behavioral8
• • Target
    service.dll
  • Size 299KB
  • SHA256 af0f7afac3760cc02ce84b9786a9af57350528c7e21fcdbbfa1ad59a9e6e3b52
  • MD5 49e40c2655776eebc3932980bc790a58
  • SHA1 67764e2a59555e8a2e82eb3fe6937aad4452276b
  • SHA512 135582d2f5ec35cf8c5469b55d8d6a670b01435c12829ae932dd3337c67129c2a5e2d61b61f92701a33f73b74c5f03da72ed2e498c8c9a724b2f6f37c339da17
  • SSDEEP 6144:E9S04KHFpQnZaXoiJp3LshZvzWyMIx5om/95nYWN0yhtEDm12aDuJn:EI04KDQZa5pQhw857znYe0yhtEDm1zuN
  • TLSH
    T1FA5423CA388DD4B8F4E40D3A68919D4DB0DEF5D827859E1B362A04E7AB2D193D11F721
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  discoveryupx

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral10behavioral9
• • Target
    vcruntime140.dll
  • Size 127KB
  • SHA256 98aea63f7c88d733504c08b165fd68a917e256f2cfaeaa742323ef6dddbbce29
  • MD5 d59f36ddcc7460bf5bcd9fde274982bb
  • SHA1 062ed05bfabfabe77d63cfa991f8471475aaf776
  • SHA512 2dd1da4d55ff8a8e2f8528d3c3afd0af31eea5d049fa9dacebac0f194d9a8c265f10426585b734126a3cafe853e7807279ce39e27d95df314c8c9acbe7d1f079
  • SSDEEP 1536:s9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaE/nzR64zESqY:sEnsvReGsWyxLizXFkecbd1aIn34wT
  • TLSH
    T1BED39D85B2A402B7D16AC174C2E3AE17FB75B94487A0A3CF03B59A650F53BE09E3C355
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral11behavioral12
• • Target
    vcruntime140_1.dll
  • Size 58KB
  • SHA256 1a1ca015a830a357ad5ec882845d732a60368b6c0d8247a009140cd518377f73
  • MD5 0bdae05fc660c889f1a3a6fd0d7ca3e4
  • SHA1 48572d0da1d1b576f8d9bee7079b2e73edd1f23a
  • SHA512 84d3ca24b54fc50c86e497e9853b4e0c49f65f04b09879af250471b4416a025dfd4bf393b32e494329c2d05817a811bd3c69d80e0d3dae86d567ca73c85c096b
  • SSDEEP 768:UzzO6ujT3MbR3v0Cz6Sz5q83ywPg1HfV9zxfkbK9zqaQ9zoQ:hq/oMx3hsHfnzxfkizqBzoQ
  • TLSH
    T116436CA457784082D99B98B0C1EAEE537D7CB7D60B10924B0BE5E5481F633D1EB3D22E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral13behavioral14