Extracted

• • Target
    DF-202601001301.exe
  • Size 451KB
  • SHA256 5ef3fe4a5e70d3750a11c73902e35b50b9ac007e8a95dde0569bf6bae17da73a
  • MD5 cb39911e14440fea03b4b1d1d0be174d
  • SHA1 788e88052b9713bc3c311cb2950d1eadaa0a09fc
  • SHA512 94bde5bf1cb0bb530da2639be33d52cac596fe5334075f2486dc037c038133a52ffd313ad669a9cb94228ca3bc0ce601a914965fd1c8eb9a347068dbffcf7dda
  • SSDEEP 12288:f4tScU2NR/IHNTgasTKV+KGoS2Rqyi1/w9M6Bsb:f4tk2YaasTKPRqyGjCsb
  • TLSH
    T131A48E217667C136CA5282B04E7DDBAE907DABF00FA268C7B7C40EAD5D700D16735A1B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistenceratspywaretrojan

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Checks for common network interception software

    Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.

    defense_evasion

  • Drops file in Drivers directory

  • Looks for VMWare Tools registry key

    defense_evasion

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • DCAgent remote management tool

    DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor

    backdoorrat

  • Adds Run key to start application

    persistence

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Power Settings

    powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

    persistence

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral1behavioral2
• • Target
    mfc140u.dll
  • Size 12.5MB
  • SHA256 0ec84ae773c44efef438c5e9eecc90e37aa5e427177daf301b1d7048dcd070b8
  • MD5 4d24c4183ffd1aa483db7db6f2b52dca
  • SHA1 85e4eacf6b388d61c1ca662878013c3311e52e7c
  • SHA512 29de83bd6f1a82ec7d0cf49169815c1ab605912dd681cc948a10bf197e7aa17d54ee935506baeccaff532bd33eac2bfb8491dede472445d8f57444c7e759d841
  • SSDEEP 49152:CnsGT8sqW4asNX16uDyBIS9LhoE9or29ab2IxqObGPFXYb6WTFKB/l/X9ih:CnSW4as7DydKE902Q2kZ+FXYlTh
  • TLSH
    T1B0D6D0148722D9DBF27DD1F278EDE015C1383C7848075922B79D2B9E7ED6A22D21A31B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4