Extracted

• • Target
    Open_to_view.exe
  • Size 25KB
  • SHA256 de0b9b6656c9e9fc9db4271610a09c2ae27d07c5a4757e94b2e0314a9dda6ee4
  • MD5 e6363b8ec386338ce08f159a739f0e97
  • SHA1 331e7b016cc9d497463c8519086cf2b9e07c21ed
  • SHA512 aa2998c56f85c70e2bfc02646d67c3cf586b4335226a248845b548be95b4451d6e778d3d79388b411f8a5669ee6af02473c73a808d2b40a4c906c2b9afa81388
  • SSDEEP 384:RpK9Wnrf8uylcxFYQt+hQlP0A1r2VHRN7DDtdQ5R9zC4W9rQ:e9WnIuyCr+AO1ds9z+c
  • TLSH
    T1F6B27C82A39854C2ED6795B0D2B4E253AC39779A0B50D2EF1250E65C0F623C5BE3C72D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistenceprivilege_escalationransomware

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2
• • Target
    winhttp.dll
  • Size 208KB
  • SHA256 14e261553c4dba16c53a50b6f1409858f7a897d1c2314e94d222273527452e34
  • MD5 4c04e19fccf02a49cb1eeadbbd5a7511
  • SHA1 a3a16f96f5c1771aed7445d12d07d7a8ca74196b
  • SHA512 5a8792e8433af2f2832196a8b55e75e3ea7aec6b18c19b2b7fb16b58615460d7e71ef9813474b19dc90de5bb97266db6470637d877494404e6bf569b49ba349e
  • SSDEEP 6144:0XCxuuG0J8J4iCIPea0rqWv/iFVB6I3dpe2x3AWG5bDF3bMK7sD4Z0eLKj5UJPX/:0aRJZ4Pea/vFf6I3dpe2x3AWG5bDF3bP
  • TLSH
    T118240243C7A73DC4DD3BF2705AA3B73B96307805864ADC4947814F6AAD4AAC03779C6A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistenceprivilege_escalationransomware

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4