Extracted

• • Target
    No.22102026-3.img
  • Size 6.4MB
  • SHA256 e09046d3967e4f8a7d44680029d1f19f8e88f668634f7ca4ae6b0e01e21295d2
  • MD5 28c9023e93e51dec285b67f19f112b6b
  • SHA1 f3739c55d7cea6ee714e3c1d27620d47897e34c6
  • SHA512 04add11b1f33bb141243be727b3d68663766fd8ec7365e4775d85c469e8184dc6bc15b942d37271cbf368cb68e5f36c1ed1253d3b9ba4f47d38bcd441f22f23a
  • SSDEEP 49152:XIKu0fvnzJ4hs9AWro03TW3FEtshmR99:bXzws9N96E
  • TLSH
    T11A664B77611F2B4DD7BBDAB184FD002A35119EA502934E92AFC46D3CEBCBE44E214726
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral1behavioral2
• • Target
    Q2
  • Size 3KB
  • SHA256 0bc6c7b5c8f6d02807bfb74c2508ffcee2f42e9c0f2294f1fcb05a7475f462e9
  • MD5 4a7cd6a3fe0d00be384f17c64e5d7aab
  • SHA1 06cab8db832a6723404e83bbf73798c968c1814b
  • SHA512 afc6099e1cb2bd012c23e4626291b08b51384cd1e21ca1f4f6d2e6cb97fe267b3f43768aefef4a1f8188c7906a714869d48cb167d1495932a90d269e2d8b8385
  • TLSH
    T179611A682499C0DB9DB9213667C07230EC5FADA70CB41B07FE596870C1FF54753A9A29
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    check.exe
  • Size 253KB
  • SHA256 78fc25ed9a673f26eadf03dd5472dc112155138410cd5c81f8b89ccef5bf0736
  • MD5 c663ac03855f3e7ff9fde06bd6e24aec
  • SHA1 2375e27170527ab4af65919b51079d1953fa4ef4
  • SHA512 59102fd9051694953b1935b353e8a5e15b578fe3196d8a30447c7eba1bdf312a2b3ae195d7a11c46ca70365e406a44d1b630bed7a4973a46a434cfef5351ea9f
  • SSDEEP 6144:RPLlFC0kFH9n1C75Ej+3CoEeVXoNKz/56XYKJ:RPLldJz/QIKJ
  • TLSH
    T180444B716E8944BEEA93E033CAFD3ABDB2689513573040C77668162C8D105E32F35A6F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordiscoveryvalleyrat_s2persistencedefense_evasion

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Drops file in Drivers directory

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral5behavioral6
• • Target
    libcef.dll
  • Size 6.1MB
  • SHA256 5de45b44e13a3dcfdb1485786a46822340dc91010adebfceb0c036ea5a49f72c
  • MD5 5bdbffdf587c949c2c40189987d00f56
  • SHA1 2b0dafcd57c5ecd7e2574f8e379e6e657df15b9b
  • SHA512 cbdcc7c9ee95e08c7d10467f765341159bcba0c9eb6f125951167faa279864a53263246e7bfde40e56387b064f24436b851b5737edcff1500f05b6d5eee167d7
  • SSDEEP 24576:MUK6BZvnz7SvkPP4h4xSsAnWr6Xd03TR0FRAWNEdClxdnOHse9KAlRSkFeeB8upq:M0fvnzJ4hs9AWro03TW3FEtshmR99
  • TLSH
    T12E563B77611F2B4DD7BBDAB184FD002A35119EA502934E92AFC46D3CEBCBE44E214726
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral7behavioral8
• • Target
    rules.yar
  • Size 1KB
  • SHA256 f02004259767b9ab5c7479e8f59b89bab47d77e6c84a1089dc0c998ed734746f
  • MD5 52f43b542245abc3935d7b5be7e398ef
  • SHA1 363d663cbbade752786b3e21c6459a5391ce0b4c
  • SHA512 5309e5206f2c075295ee91415d77c561db3895efdee1f12ccff38f3c9c9a7daf04242eed0aec81b7e30105d4eb0d7762a35059529acd680be5a614d6fd0bcfce
  • TLSH
    T1F6312C073F602A71644E02E05AE3A42829806723B22578B03A0E90DC8F2B93DD5F398C
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral10behavioral9
• • Target
    stage2.bin
  • Size 2KB
  • SHA256 5b76b37c13c729133179ac8cbf0bda473ca692e6ba08337eb4bd42e4d2aecf40
  • MD5 f1c24def5f3d9e7d2b496a99e7788153
  • SHA1 b095b7919d83142d28e6df249d5ddabe2143cf0d
  • SHA512 7fa106bca0704183105bfee1e8235861960f87cb82c61f9bb08f29796aca61faebab6414c757d3ee4a9340c2ea1ddf0708e8a6b8e687e67825189c33d7423323
  • TLSH
    T1C141C69A6D8023C9D9F2C87A41CB1233EC7490364C182DC5E3C59316DD12103B05083E
  • MD5 SHA1 SHA512 TLSH

  Score

  3^/10

  execution
  behavioral11behavioral12