Extracted

• • Target
    2026.vbs
  • Size 2KB
  • SHA256 8bc8cf4b939e22ffcd3175db5ba539b3e9d0f709c071062a5eca4104261b7293
  • MD5 50d534a8e2f3a5da9a9f165992c6f58e
  • SHA1 b7e22980579a054b9c4b2f8da2db652a11039fbf
  • SHA512 0e60d495bdc5feac560f3db9fefb4cae3a10a22ac8b3d89d8b51d87c1e935655d1eab67efc73cad8fe8810fa90a4c4bd2c639101ced2e48a5376763f0b028087
  • TLSH
    T1FD51694F9C1F69A30A73B6F44B43472DEE1BF637033560547A06ED962B34088F49105D
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutiondonutloadervalleyrat_s2linkloaderpdfpersistenceransomware

  • Detects DonutLoader

    loader

  • Family: DonutLoader

    DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.

    loaderdonutloader

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2