Extracted

• • Target
    Notice from Tax Departmen.exe
  • Size 1021KB
  • SHA256 bfa5740f028a8f310ca01c779bbc5f2f1b435c41539c54de592f715bb0c10389
  • MD5 f0a4d5c3492115bfe2f346bc7bdce396
  • SHA1 bfcbdc7d0cbb92b68d348090fe9f381b4358a587
  • SHA512 8e4b2e1852fbc821cab4a7c16675afbfa2588472faa1848600829c415bfbee7cbf4713568ba15a76916e6c761d79b0fff7c5a1ae087aabd912bb7063d38a560a
  • SSDEEP 24576:uGKuKkPztKt9cHPrLRAqKBAy1N1UGAmnnnFnnnZnnnGnnnsddodt:uGKuKkPzgt9cHTLRAqK81k8
  • TLSH
    T1A9254B1BE7A345EDC56FC13487A7C772AA30B86942347E2E1D95DB221F10E609F2E724
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistencetrojan

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • UAC bypass

    defense_evasiontrojan

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2
• • Target
    libvlc.dll
  • Size 2.1MB
  • SHA256 bf925516c54ec083532d22c4f7dec9bccc3104f2407fa38a047541776d89c13d
  • MD5 0ebb87d0ed77b7878336d0a1a3ec3263
  • SHA1 874dc17d2b8b601b266709d9e6a151cf14c0db60
  • SHA512 37d94598a0034aedbd81a61df8c7aa1cd1f0eae9f859259745d913ffaa5f7b06a6757ad3a5e3c21064133785524c47f701ce3b6243591f717a002ebb6c61b874
  • SSDEEP 24576:8YUwFrqbec7nudKw2x501woJUwbsS7nuhGumgdJjrG8BrSrTY:8YVrzdX2Pum7FAyrSrM
  • TLSH
    T168A55CFF67440968D0E770B8AC563083AB61BE374670E9890B5337475F2676F1E2A21E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistencetrojan

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • UAC bypass

    defense_evasiontrojan

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4
• • Target
    msvcp120.dll
  • Size 644KB
  • SHA256 3b92e964404e3f94531e7d7c4c7419561d9eca6accd98dc3979c9e3596db444c
  • MD5 c2028ba6c66363b36ea659ca8816265d
  • SHA1 5e2bda10ad417466290dc08fd6ee8bc5fcf0ebbd
  • SHA512 28e87d7360c4bd2eb30152173da6fdf30340b5ff0186a68f26514088dcc15758851afd01a179e976a91a9a85f9c1ee0cfa40308ed9d42654739acf6f6dd773f4
  • SSDEEP 12288:FOB4p+q4N8d4l2ms4cTHN+m+gy/vEPYysExtvsIvXi1ZG2EKZm+GWodEEpvY/p:iAtvsIvL2EKZm+GWodEEpvYh
  • TLSH
    T1ADE45B13FB150AB0E192D37891D78741D7F1BC898822F30752ABE27D5F67391AA2B361
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    msvcp140.dll
  • Size 572KB
  • SHA256 b5400f8454276f1adf944d8ba393866ca423603254baf88bca7dc4c1cf762116
  • MD5 cdf7a0cc26ed6b4136ce69b74d8694ed
  • SHA1 9d7775e53b051a150bd461b0cacebd206bf875dc
  • SHA512 deb4397ad18f0267463ac69e629788f5b9c90265ffb69d1f2c360534b6df7c2a0da3c389916430f3a4675ad8ba29c6c6c95dafee07480bfe74fa913934677abd
  • SSDEEP 12288:49zqgpPAgLqMpP85TAfvULhNaYv0nJxgQEKZm+jWodEEVht4y:44wPrALhAYvogQEKZm+jWodEE7P
  • TLSH
    T1C9C41923B74905E0E195E3B891878706D7F1BC4A8312A3C792EBD69D2F673D1673B290
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7behavioral8
• • Target
    msvcp140_1.dll
  • Size 25KB
  • SHA256 086e083da4e7a46438aff3188beb2c0d14cb38af216c62a880cd8209dfcfcca8
  • MD5 6e10c7dff6c6f55ba43c784037958341
  • SHA1 82afedb28493bff8ba462d0bb012fdc35d25984e
  • SHA512 6135353999206fc1f8b9bc52fa2383ef86d999a0d903c2806a3f621cc68c34241ace70c8c86f6589dc41d84ace5d79ca46f8ba83334434826088dc4d29bfc8de
  • SSDEEP 384:mDN8AFcc1nOx9dq/1Wc15gWWCr2VHRN7dFDtdQ5R9zrjdb:mZPFccIxPq/TJOdDds9zvJ
  • TLSH
    T196B25B86EB14C846ED564830C99ADE436A39B7D41B50A7CF1395BA1C0DE33C2FE35A2D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10behavioral9
• • Target
    msvcp140_2.dll
  • Size 252KB
  • SHA256 5fd1bf62b065bd9a8bcbf8552d9ffd24f96341c10a4b93c5be0282a2f704fb2e
  • MD5 15c26b825ab7dcd52472746fa0f3cb1f
  • SHA1 7ad10975109e2003b1d7ea10cd98a22cde8b8dfe
  • SHA512 6b2fb0a880b28e3fb939280dab52a5a6679b5dc603c9c80457840eb81c451124b5617a4571d6ede034f6332b2b11c2b65ad62287edbec739baf83a12ad83dc6d
  • SSDEEP 3072:tlNIQs3d7QsQIPxv+evBCiuxLQtDVbqyFjOqGUSHNKtdjhESjUJ2aRAAuO1UL9ZT:tzPnIPB+W9FjOq9CcrjhKJ36ve5vWY8R
  • TLSH
    T1FA440716B5092FBFC8E6A4B04939B412FC2A36405731C48A16C32D4DAF1FA577EE356E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral11behavioral12
• • Target
    msvcp140_atomic_wait.dll
  • Size 39KB
  • SHA256 d4fdd222f3f2880651edf6802bc44710a3d66c691c3afb7fe2bf3229f06ff935
  • MD5 32920dc27d6663b544fa57760642ba7a
  • SHA1 b819a651e97d2e07da580e7cfa468201b9304a61
  • SHA512 083ad5a8db0511a9ab386342658e0b5197edcb873fd8db8f6aaa87806da8091ba980dde843eb378c201d873dab75ca1f6be47bb3607ea12d949b0f6492717bd9
  • SSDEEP 768:DrulGoz1ViLdOfv+rpABXeGHasDFvR7in9zt/:qGeiaKiBXeGHasBo9zt/
  • TLSH
    T1AE036C5E63A44482E46746348062A62BE7BB76E24B10D7DF5721F09E0F637D0FB34B1A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral13behavioral14
• • Target
    msvcp140_codecvt_ids.dll
  • Size 21KB
  • SHA256 109312ce9e35c66c8f411d1fc74aba902c46cd65ca40883d2eb779fb09031c33
  • MD5 03243cab6858eae7faa4425c1d3e02ac
  • SHA1 98c8d460ffb2d676e6ba6d7116f0b1512bcd605c
  • SHA512 63e41f7193f185832304e47b42764d73c82833c327d2c3bf73fb06b3905591328da036b3746439a63582742b39ff40c7a94a4408068381e784203d8b04d3cae0
  • SSDEEP 384:Z4DgP2fsle6WirEWVr2VHRN7DkELRPR9zywhFn:sgPw/onOQQ9zV
  • TLSH
    T13DA26D86E6284547ECAA4870C1BECE477C7D77921A20938B13A1F0191DA33C7EB3566D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral15behavioral16
• • Target
    vccorlib140.dll
  • Size 336KB
  • SHA256 430accf44c39446446cf541174ad4fa4e8a25e603c389a524caf8de1606e45be
  • MD5 522eff8c1303dee8bd8eb385a0c20e9b
  • SHA1 5957f5d1a8509c772c15eb6de268d9b52f66dbee
  • SHA512 023651994cd23a722af0c81bdc3269f6de6a16174b5ab13f447b9d248e85e008eaa19899f5023dbd65933263e671aa00477d15dbaaf47d85201fef99b942f68b
  • SSDEEP 6144:aep8WHdoHDGzBb/Cpx+/hBgyzgMXxUc0J3etWGx0CttwV2eo+lLXuF560XA2eUSL:VtmJO3GgtWp1qVXAfF6mJ19Mq
  • TLSH
    T18574C56B2A9C0CD3CD3160760E979309E3B278510B61A7CF1691470F5E3FBE4AE7A664
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral17behavioral18
• • Target
    vcruntime140.dll
  • Size 127KB
  • SHA256 98aea63f7c88d733504c08b165fd68a917e256f2cfaeaa742323ef6dddbbce29
  • MD5 d59f36ddcc7460bf5bcd9fde274982bb
  • SHA1 062ed05bfabfabe77d63cfa991f8471475aaf776
  • SHA512 2dd1da4d55ff8a8e2f8528d3c3afd0af31eea5d049fa9dacebac0f194d9a8c265f10426585b734126a3cafe853e7807279ce39e27d95df314c8c9acbe7d1f079
  • SSDEEP 1536:s9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaE/nzR64zESqY:sEnsvReGsWyxLizXFkecbd1aIn34wT
  • TLSH
    T1BED39D85B2A402B7D16AC174C2E3AE17FB75B94487A0A3CF03B59A650F53BE09E3C355
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral19behavioral20
• • Target
    vcruntime140_1.dll
  • Size 58KB
  • SHA256 1a1ca015a830a357ad5ec882845d732a60368b6c0d8247a009140cd518377f73
  • MD5 0bdae05fc660c889f1a3a6fd0d7ca3e4
  • SHA1 48572d0da1d1b576f8d9bee7079b2e73edd1f23a
  • SHA512 84d3ca24b54fc50c86e497e9853b4e0c49f65f04b09879af250471b4416a025dfd4bf393b32e494329c2d05817a811bd3c69d80e0d3dae86d567ca73c85c096b
  • SSDEEP 768:UzzO6ujT3MbR3v0Cz6Sz5q83ywPg1HfV9zxfkbK9zqaQ9zoQ:hq/oMx3hsHfnzxfkizqBzoQ
  • TLSH
    T116436CA457784082D99B98B0C1EAEE537D7CB7D60B10924B0BE5E5481F633D1EB3D22E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral21behavioral22
• • Target
    vcruntime140_threads.dll
  • Size 27KB
  • SHA256 2f2709047b2e0ec13e4e344f0a044453880fb179522f995d848589ad5e31637f
  • MD5 197eeb94fec5cd4e82a04005dcf2fe47
  • SHA1 d7dd929f853f1edabc8680c91abf38b6eeb6a197
  • SHA512 a8df4e656012240572b4de241a285ae9d2a09f135d8b51b104faa00fb50f2480c7178e158e6a1f38705c61ecbd39dbcd6edaf35734fdc0a1d7d78109baf5ebfd
  • SSDEEP 384:LD5EQ+DbxF4y+LMVHWzj27Z9gf3moarJcpWrj+W6r2VHRN7EoJR9zRF:LD5EQoVHOj263mo0paOz9zP
  • TLSH
    T123C28E86AB6484D6D5EB4470C5BAD947ED79FA920B1082CF03C0FA890E773C2E93971D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral23behavioral24