Extracted

• • Target
    07096260da7d62c70fc17290a7aff587.exe
  • Size 172KB
  • SHA256 262076f79bae001a6be7471d10d022add128364ffa085f22dbf6f01b5f4d2bf9
  • MD5 07096260da7d62c70fc17290a7aff587
  • SHA1 6d31bf396743d01b6977455d8fbbeee899ac6f8d
  • SHA512 fca8a5e4575b74e2370f35a21609681418812a7eb070d016e63e7dd8a75c74bb81b27fce2f857b793b61c380b7903165ef40a07c0bb678f3a52855baf4505971
  • SSDEEP 3072:hbc1805DEzmdvIG6mfY10lonkVgkuqkI7gN1F4+Nky7qZi1F6nzC:5W805DEydsmA10enjkNkvjF3dCxzC
  • TLSH
    T14704F11BFA1640FDC40BE53405D32277E232B86873218BEDB762972DDE608356A79F16
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasionvalleyrat_s2persistenceprivilege_escalationransomwarespywaretrojan

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Windows security bypass

    defense_evasiontrojan

  • Downloads MZ/PE file

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Windows security modification

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2