Extracted

• • Target
    ContactActivation.dll
  • Size 46KB
  • SHA256 34e13ed45cbfead366ba88a1afabe8e226ba897ddb4375be19b20210385b88dc
  • MD5 f261d92de9efb9b79e8704c02e999f2f
  • SHA1 81c4d907d176457ac6b406569f51596f15c581a6
  • SHA512 48a205bb8ad6a6bbadc0b03d1130474ede4f1316757d7e5a297a3bd016293d072f52adc3692acbdc80c50a664501d6169b1c19aeb77ecce73c98bbfd5d389742
  • SSDEEP 768:PYrAVt1WhuNUWUgIc0g58GRZ9FvVqUXidfY26XeYMLiY/5Eqh63PncU2Omp6UvzF:aAPxUvgIc0g1RZjvVtXieSYMLiY/5Eqp
  • TLSH
    T15F23F5225F9829B1EBA33AB4292EB138942DB9124BF051C70F134AEA5C257D1FD3715F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral1
• • Target
    CrcLiEnt.dLL
  • Size 5.6MB
  • SHA256 b9fd61498d6345769dff6a33a8334c24cba3a03b3c0cb65acf95882bdc5670b3
  • MD5 7e8d00b667f7368a5e01860342419b07
  • SHA1 6a2025bdb833f875779a101aea13557d6c60faf0
  • SHA512 aad599881afda0c1d384adc06ba877e1c12e230f0d150e24690a784a53aca8148c1cc91596e25a94e659a383330a2097f73e39309541315112cab5c0191796cd
  • SSDEEP 98304:AO7L2n0i7nc86NlSCtTKbdo6ClG9UeRPuH/yuK0OF:AO73PNwC6e+DU
  • TLSH
    T1DB46CF467AF840BAC4B6C172CA678AAFD3F274410D35DB1F42810A4A6F777619E1B336
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistenceransomwareratspywarestealertrojan

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • DCAgent remote management tool

    DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor

    backdoorrat

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies file permissions

    discovery

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral2behavioral3
• • Target
    M20261015258.exe
  • Size 1.1MB
  • SHA256 81cf4d59df869abfe5034d160090d88bc9c573e8c5daf284fd29417d48411d5b
  • MD5 8cf96be406d5b55912e4d79c2a533568
  • SHA1 6f6a4f2802e72ce4b0eaad1094bb53a585bdf5d2
  • SHA512 83175422ed11d694d31f23b71daf2992c1794be2250023a580490464e57bf3c8731a407d3a50bfb681f5c22fa76de2d82a88b9d1b3c4c591603dd7fc0e53ba3d
  • SSDEEP 24576:+8q1L8bEuXsj6ME5pvOIogH5zpPNTKGKmmUYUsK2:FIL8bdXS6MSpvOIokpVTCUYU+
  • TLSH
    T1FA356C0793E902ADE0B7E13C89678906E2767C5A07709ACF13A0795A2F737E19F79311
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistenceransomwareratspywarestealertrojan

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • DCAgent remote management tool

    DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor

    backdoorrat

  • Modifies file permissions

    discovery

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to get system information.

    execution

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral4behavioral5
• • Target
    eapprovp.dll
  • Size 43KB
  • SHA256 e421ad26faf20c23543278c6ff9cacd57472ab7999d9dd4eac94a24858a527f8
  • MD5 9010139e7422b62726f30ada72b89223
  • SHA1 89fe41c54c0644f09f1bf95be0d330cc463b24e5
  • SHA512 4294e2dc779e48b629b12a71755c8ec23207878f81fcf0f77d55c6929f2a2fd58c29105d007838df54f50cbd802371e4f02e227e75eec18aa8a244d12fa4fe59
  • SSDEEP 768:y90w06opKx2bmnHy71uRoHkBilp6/c6g9:+A6o9mnHy71uRdBi36/c6
  • TLSH
    T1DE13D500E7D948B5F7F23BF224BA562A4D3BBC505E71C9CE1122875D7831A82E872727
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral6