Extracted

• • Target
    115Q3申報清單.exe
  • Size 343KB
  • SHA256 6d3fee81ad1339b8e9a2ae7d24669fc9ad9ec84c3b13932289fb20a25bce5596
  • MD5 a8c9c91d9f556ddc4c3dee2e7af7c140
  • SHA1 05cd34af731e5f29a9fe5b7950c25450a893b20e
  • SHA512 3aace6b6ac91b50bff730a2a01c1c1fc7ee50b932d1464b82ff2b3ea265b033c5b67067a92f1968dd56f619a22f0ab75ad28311a6c0ce73a352a03f3120472fc
  • SSDEEP 6144:yheV9dmppO7+6q4XZ5iNmlRO2Wst9t+jX:yh6h+KTDRWsntu
  • TLSH
    T1CF743C933B5A1C96F897C0394657BE02EB727C990312C6DBA360B55A5F3B6E03D78E10
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryvalleyrat_s2persistencespywaretrojan

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2
• • Target
    DriverLib.dll
  • Size 387KB
  • SHA256 d1f93def665db5c4debf60314af20c13f054913bed2241dd370bb20b43245f5c
  • MD5 f9b195c25ef24ad6c3d9cb84ad163233
  • SHA1 51ce94fbc6980d7f8e06fc42531b927854e069f1
  • SHA512 62d3ba908a034846b9e54b8bdc787482b9a80839f327a1efd5cd6d340ba99ecf7e5c0ee83b76e9b75fa5f6be2611d42796933f88a36800bfb438601f157ac09f
  • SSDEEP 6144:8N9/TrJmP9K+eeDnjmGhsBOa8CQYOO+2LKHxXR/iinpoO:8N9/PJL+fDyGCBGCRHGHxFtn
  • TLSH
    T1BF846C4AF7A40475E0F79278CD735906DA727C5A0370D68F23A4465B2F37FA0AA3A721
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  • Executes dropped EXE

  behavioral3behavioral4
• • Target
    appshare.dll
  • Size 251KB
  • SHA256 339cef1ca6daa65126507c76b5ff93540d4696329370750129039b760455af6b
  • MD5 d851b136bed962463d079d025799e6f9
  • SHA1 3ae5afa8cbd7822598f0077e94a587ce4bbe3f8b
  • SHA512 f50245c56ebb83a35a9b2c7334bb86f07f661b50a1e6ea07ee49f97c6c543a3f8621ee042cbc8762a8bc84f710456e1e3e0f596f99d3ed0eaf7a08f9aa4d3e4e
  • SSDEEP 3072:Rkcg8XxocWobfaa3gZ4Mb5k+51RIj6lMXMSpAZAqCQmfCJ9uOuXFb+EUWLqouZA3:jfZ3guM9kq1R46qvpFCXyLuNoOKfp
  • TLSH
    T18C445C5673E40C74FDB79339CD634A05DA72BC524761EA8F03A0425A9F3BBA0653E722
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    mediastores.dll
  • Size 248KB
  • SHA256 02f7f062d9065e15b064afd94137da0723ac19db953733800ea3a04394ba44b5
  • MD5 30d90bec43a43d238788d2ecd4b0d2b8
  • SHA1 04d2ee43de24b328cece7a530472b19e19a39319
  • SHA512 d1155b4278a2ffa4d49b8698c7e89ae638ec82fffe08e901c87b37b1527a3ec5507261183ba85492721dfe432f215701f53d33fb201de8087bf0332c88c8f054
  • SSDEEP 3072:P4rdtoPiLB+aInY5cGqKZKi1Ncho0fUf+M6uINQkd1q2M3vETo/jK5oIQ28xwR:tqLAaInilT4zUfv6uqt1q2WET+fxy
  • TLSH
    T1BA44294B665408F7D8ABD17C89878A07EBB2391A4351D7CF07D0965A0F0B7E1BE3AB11
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7behavioral8
• • Target
    msvcp140.dll
  • Size 553KB
  • SHA256 3048df1cf8d476e998dde28ed6b67856b47ec5ae2b2c221fb1733f43c550c701
  • MD5 e3791c5b54bd3f1d2a61b1beff9ef5f2
  • SHA1 f55535eff838a93bcab300673e93447c3d0a54ef
  • SHA512 14931c8e05484989bdbea942f797b0e3d1ef6fb1e60a47b30f3f84b56adc35e18a3c7943004f75e96fbf1a2d5df0452b2511a18418705b3c84c57f2d11b11c04
  • SSDEEP 12288:0Tv2OuTt6DRh4l0PU+tDLjfhQEKZm+jWodEEVT6um:0FU+1hQEKZm+jWodEExZm
  • TLSH
    T186C41923B75905A0E195E3B891838705D7F07C4A8322A3C792FBD5AE2F5B7D1A73B250
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10behavioral9
• • Target
    msvcp140_1.dll
  • Size 25KB
  • SHA256 086e083da4e7a46438aff3188beb2c0d14cb38af216c62a880cd8209dfcfcca8
  • MD5 6e10c7dff6c6f55ba43c784037958341
  • SHA1 82afedb28493bff8ba462d0bb012fdc35d25984e
  • SHA512 6135353999206fc1f8b9bc52fa2383ef86d999a0d903c2806a3f621cc68c34241ace70c8c86f6589dc41d84ace5d79ca46f8ba83334434826088dc4d29bfc8de
  • SSDEEP 384:mDN8AFcc1nOx9dq/1Wc15gWWCr2VHRN7dFDtdQ5R9zrjdb:mZPFccIxPq/TJOdDds9zvJ
  • TLSH
    T196B25B86EB14C846ED564830C99ADE436A39B7D41B50A7CF1395BA1C0DE33C2FE35A2D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral11behavioral12
• • Target
    msvcp140_2.dll
  • Size 252KB
  • SHA256 5fd1bf62b065bd9a8bcbf8552d9ffd24f96341c10a4b93c5be0282a2f704fb2e
  • MD5 15c26b825ab7dcd52472746fa0f3cb1f
  • SHA1 7ad10975109e2003b1d7ea10cd98a22cde8b8dfe
  • SHA512 6b2fb0a880b28e3fb939280dab52a5a6679b5dc603c9c80457840eb81c451124b5617a4571d6ede034f6332b2b11c2b65ad62287edbec739baf83a12ad83dc6d
  • SSDEEP 3072:tlNIQs3d7QsQIPxv+evBCiuxLQtDVbqyFjOqGUSHNKtdjhESjUJ2aRAAuO1UL9ZT:tzPnIPB+W9FjOq9CcrjhKJ36ve5vWY8R
  • TLSH
    T1FA440716B5092FBFC8E6A4B04939B412FC2A36405731C48A16C32D4DAF1FA577EE356E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral13behavioral14
• • Target
    msvcp140_atomic_wait.dll
  • Size 39KB
  • SHA256 d4fdd222f3f2880651edf6802bc44710a3d66c691c3afb7fe2bf3229f06ff935
  • MD5 32920dc27d6663b544fa57760642ba7a
  • SHA1 b819a651e97d2e07da580e7cfa468201b9304a61
  • SHA512 083ad5a8db0511a9ab386342658e0b5197edcb873fd8db8f6aaa87806da8091ba980dde843eb378c201d873dab75ca1f6be47bb3607ea12d949b0f6492717bd9
  • SSDEEP 768:DrulGoz1ViLdOfv+rpABXeGHasDFvR7in9zt/:qGeiaKiBXeGHasBo9zt/
  • TLSH
    T1AE036C5E63A44482E46746348062A62BE7BB76E24B10D7DF5721F09E0F637D0FB34B1A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral15behavioral16
• • Target
    msvcp140_codecvt_ids.dll
  • Size 21KB
  • SHA256 109312ce9e35c66c8f411d1fc74aba902c46cd65ca40883d2eb779fb09031c33
  • MD5 03243cab6858eae7faa4425c1d3e02ac
  • SHA1 98c8d460ffb2d676e6ba6d7116f0b1512bcd605c
  • SHA512 63e41f7193f185832304e47b42764d73c82833c327d2c3bf73fb06b3905591328da036b3746439a63582742b39ff40c7a94a4408068381e784203d8b04d3cae0
  • SSDEEP 384:Z4DgP2fsle6WirEWVr2VHRN7DkELRPR9zywhFn:sgPw/onOQQ9zV
  • TLSH
    T13DA26D86E6284547ECAA4870C1BECE477C7D77921A20938B13A1F0191DA33C7EB3566D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral17behavioral18
• • Target
    util.dll
  • Size 1.4MB
  • SHA256 889c8747e20356a83f7e81c1206de869beeed3707408716656ab5b5a14451044
  • MD5 1d37b895bdba65c274df607b212774eb
  • SHA1 0b4ceb589c01cb9ce4a59194d2f1cec969f93f1c
  • SHA512 44f25f52921ecae4256c63fe45c496c419ec509220a9dcc4bd9cea2bd2c2b3485aae581771f94cbaa3ddb38eeee7e9d18a3fb446d7b5b0f465476f3875a28f79
  • SSDEEP 24576:/lYdN1TFOxYFzgq1vmz1K+M4bNclnCKqYh:9YdNdFOxnqST1bNclnj
  • TLSH
    T1BB654B890246A6CAC855F53CEE42A413F3F6B911035DCEE7943184BA0F772E69A7EF41
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral19behavioral20
• • Target
    vccorlib140.dll
  • Size 336KB
  • SHA256 430accf44c39446446cf541174ad4fa4e8a25e603c389a524caf8de1606e45be
  • MD5 522eff8c1303dee8bd8eb385a0c20e9b
  • SHA1 5957f5d1a8509c772c15eb6de268d9b52f66dbee
  • SHA512 023651994cd23a722af0c81bdc3269f6de6a16174b5ab13f447b9d248e85e008eaa19899f5023dbd65933263e671aa00477d15dbaaf47d85201fef99b942f68b
  • SSDEEP 6144:aep8WHdoHDGzBb/Cpx+/hBgyzgMXxUc0J3etWGx0CttwV2eo+lLXuF560XA2eUSL:VtmJO3GgtWp1qVXAfF6mJ19Mq
  • TLSH
    T18574C56B2A9C0CD3CD3160760E979309E3B278510B61A7CF1691470F5E3FBE4AE7A664
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral21behavioral22
• • Target
    vcruntime140.dll
  • Size 108KB
  • SHA256 9593801b89cf3c0a46056f4d923d67b5c685fb8760f007b4d194e4a6a6ed9396
  • MD5 41e66b1c590019dc99f544513c0693bc
  • SHA1 d882329c786bd1038bbeeecc58c2f3b2a085ac22
  • SHA512 8296f7e4113d4e6dbee72a7d29358a67b4ffd1e284a01a3b7fbf4e85878a07444777df6d3c2e6efdea7e7d7a1f167d7fad755f78a655cdb2b89d0330265ed611
  • SSDEEP 1536:gQOierMULrYaTw+xkU4X3X6pjxP9vPOiDxvkcYYbBD4ZecbuHcTa3xzZY:g/trT2XH6POiDxMcYoKZecbuHcTUxtY
  • TLSH
    T193B36B8A72A003F7D16AC239C1A32A16F771F8548760A7CF03A54A7A1F53BE15E3D356
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral23behavioral24
• • Target
    vcruntime140_1.dll
  • Size 38KB
  • SHA256 b49a9b9c334e66bb14e0bd784be2e0a86edc7d24a9ebf90d1b2bbd71451695c9
  • MD5 15e66163e8bdaaaf8bb775b29d9f98b0
  • SHA1 48a854b69efa1ab9ef2ebae9b465e4b8ea415ffb
  • SHA512 e9f3cd24957045ecd2fe9e175de2909474ce9c69b2c81e4575e965ab4e7b34d7ea7eef3071079b0a176ed67ca2324423b57189713b8d9312804f24dabf1a4ca8
  • SSDEEP 384:QHbrv6WeyJSGeWuh1fD/Hk+GlbjWyIhHz6Yf2Q1mPOw6U8z3WrfKWdtT7nHRN76L:zWeMk/D/HunfmHz6SC8MD1Q9zVp
  • TLSH
    T14E034B9467B84086E0AF91B4C4D76F17BA7CF9650B50938F0BA1919C2F637D0AB3E316
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral25behavioral26
• • Target
    vcruntime140_threads.dll
  • Size 27KB
  • SHA256 2f2709047b2e0ec13e4e344f0a044453880fb179522f995d848589ad5e31637f
  • MD5 197eeb94fec5cd4e82a04005dcf2fe47
  • SHA1 d7dd929f853f1edabc8680c91abf38b6eeb6a197
  • SHA512 a8df4e656012240572b4de241a285ae9d2a09f135d8b51b104faa00fb50f2480c7178e158e6a1f38705c61ecbd39dbcd6edaf35734fdc0a1d7d78109baf5ebfd
  • SSDEEP 384:LD5EQ+DbxF4y+LMVHWzj27Z9gf3moarJcpWrj+W6r2VHRN7EoJR9zRF:LD5EQoVHOj263mo0paOz9zP
  • TLSH
    T123C28E86AB6484D6D5EB4470C5BAD947ED79FA920B1082CF03C0FA890E773C2E93971D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral27behavioral28