Extracted

• • Target
    0c68cc53267bd4783768b2a33e966d054681195325e5b902fa4a374fd242e86f
  • Size 87KB
  • SHA256 0c68cc53267bd4783768b2a33e966d054681195325e5b902fa4a374fd242e86f
  • MD5 210be083eb274c404024506a244e3c87
  • SHA1 4653611b75aad514fd166cda1a8fa84a99633e82
  • SHA512 ec60e9716c640750f67c77814e4989f20b13ce3e0ca7c8f10f7f5c40d6f33b03f7b8095abf0d9ec9cba8fab13010ea10d173b7e7962c7383d20cd04ed1d03f20
  • SSDEEP 1536:rLyJb5ZIR8kgYu3gpYcQsWMUjvcdwXOI3eWoAnIlj9S:vKZo8Qu3uwXl3WMI1s
  • TLSH
    T145936C11FDAAE427E7AE4E349412DC459F227CC2DED1AC177B901ECE0864A94DF29E21
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistence

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Discovers running processes

    Running process information can be used to identify security tools or plan follow-on actions.

    discovery
  behavioral1behavioral2