Extracted

• • Target
    柬埔寨单笔干进600万u资料细节曝光l.exe
  • Size 3.3MB
  • SHA256 96debf39d8df3a36e052f0cbd045295eba503ca310387cd3367fa1d91b0da0be
  • MD5 8a1ba91389b3ad171cabea62bed55870
  • SHA1 8cc91d40362e104fdc8aace812ed8a8b90cb6ef2
  • SHA512 d81ea925fcf7398dd8bb20b9a742efc1feb8b9cc224ecac3550499433fe02cc4b6ff592a7f6748513f34f785ed4e71978eadc9c056bfee44224f5b69d4328932
  • SSDEEP 49152:X+MRdOHnGFO60YPJH8/V3uzAccJTymODFrzmbFlZ8OHidG1FRm0YtnRz4i:Xr2X6Di93uzXc5yNqrVidG1FeRz4i
  • TLSH
    T125F5F123B2CBE03EF45E0B3705B2A15494FBA621A527BD66D7E484ACCF250641E3E747
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionexploitvalleyrat_s2installerpersistence

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Possible privilege escalation attempt

    exploit

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Stops running service(s)

    defense_evasionexecution

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2