Extracted

• • Target
    https://1drv.ms/u/c/143b196a69c8f929/IQCTJbumIsuySqov_aUrSiUWAV6f1yVDukPzMp339EZsjlU

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionvalleyrat_s2linkpdfpersistence

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1