Extracted

Extracted

• • Target
    解压密码....题目答案即密码png.exe
  • Size 2.8MB
  • SHA256 bfbde322aad40bd7228d268b85ef7ec5883c1343f060d12848b6bc7550068761
  • MD5 177ae8cb7e5ebb93222133b873e7c4b7
  • SHA1 899fcdc485e807745114d1b9660ca2e406d4ad6c
  • SHA512 133d7639e3b86dd4f9110f70db24f8960e4f9d9ee9c30fdc7334770ba446cb93cb7cbc8b8653d6faf8982711a2a4e5dc21ade516fdd4765d692380019cae2d23
  • SSDEEP 49152:uypyiIp1wzF/Q347sKVbSbvDrhiDiJ0db5zM506/GW1OO4YYnV54B5Sk/8fKzc7e:uIyHPEF/wGsIbGvDrQZh651+COO4YYnB
  • TLSH
    T1E7D59A81BB9AA831F31538B0F636E42DF71AEDF65EF52656B8CBBD75C0385C80058588
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoor987654321discoveryexecutioncobaltstrikevalleyrat_s2persistencetrojan

  • Detects ValleyRAT payload

  • Family: Cobaltstrike

    Detected malicious payload which is part of Cobaltstrike.

    trojanbackdoorcobaltstrike

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1