Extracted

• • Target
    OP-5.zip
  • Size 5.1MB
  • SHA256 244fd5ecb1fe8ec99bc9006015ad9b42193f9dc6b6dc953fa4e723ca86d7f966
  • MD5 1fa04e402f25958d445b646fc460c4a4
  • SHA1 e94896e514b78b3c8d81759286b4a4efb707b0b9
  • SHA512 21416a047fba8d75e719ea4c76646f039818305291514ccf71c98268e7afc69c6c069e723be77a2901641e4cda9c0556cee989a8edba194834f070bc9f9a3fc9
  • SSDEEP 98304:d6x6CM54j/anKwYnxU2xN/9Jj31qAb/y44b4V0xgufUB9kREzZuf:Qx854+wxvrtvb6b4Vs/e9kRE8
  • TLSH
    T1B64623FDDDB941FD75BD2FD9AAA50787154A0EA34DF74C881C8391AEC931EB00170AA2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistence

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Drops file in Drivers directory

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2
• • Target
    OP-5/NO-5.exe
  • Size 671KB
  • SHA256 85314a24741a27bb969008b91f6f47e08f1a7a761eb9c772da8a608947dbe092
  • MD5 15863d6cfaebb1f75461a6c72a0e5376
  • SHA1 16247f741a9cb345e1e2ad199f60d4101a34c8ca
  • SHA512 a982eaa430a3ab3c5e7d248eef6216d463a349ec407d63a326ba8e67b99d9ef00283ec7ab9db7c14e013c990e21b028611b9ef8341f32e7768dcd54643807fa8
  • SSDEEP 12288:27ehokgmoz1Vwy+UGLOMlPGnzM2LE+vomFFb5KSIAWb5sKwIqsr1KMkPwWK7tbG:27jkgmooy+fizM2LE+vomFnvIAWOdsrM
  • TLSH
    T158E47D613642C03ED77210B00D3DDAAE107DF6654F2699DBA3C80E6D5FB42D22E3A667
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistenceadwareransomwarespyware

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Drops file in Drivers directory

  • Sets service image path in registry

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence

  • Adds Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4
• • Target
    OP-5/d3d9core.ax
  • Size 3KB
  • SHA256 de00dc70c1f4760b3ff1d6b1d188cc9aab77a31a1c576ca8fe14fffd6a9934bf
  • MD5 804f78545b3a17b358ac7ebd2f4daf91
  • SHA1 82f35453aa36d54ec6cb2956e76c009c7077a5aa
  • SHA512 e2226917c1d9a5cd20e67598eab1bf8261cff49124055b6f3da129261cf59a1463414f9da1fd05e56027d5013da71de57932d4b8ea756d2235106df6a3b4d362
  • TLSH
    T1AE615B71309542EEC29A194D485C994750A93ADEF3FD1A19FCE2CFA4125B411D1AC5FC
  • MD5 SHA1 SHA512 TLSH

  Score

  8^/10

  adwarepersistenceransomwarespyware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral5behavioral6
• • Target
    OP-5/libcef.dll
  • Size 11.6MB
  • SHA256 f8515b0e2a68b677a105ed438062223ac91e61c7796bd6cd83089e1b0591016b
  • MD5 122ca07761bd2aadc59f3f344e95aabf
  • SHA1 fb6fe73aeff1377b6c1f0b5819f93821be1e207f
  • SHA512 d8c33aeb72e6010fa2a67ab69c9ca2b4f2c6225514d53278338c3ac1f74481b89ca56ff8ab1489f24e0e22e53fb73735c4ddc310180c83c7585660e5967f6f20
  • SSDEEP 49152:oWQQFCSewjuBfaBpYc47VNR5xBJB/mPLNjUISv8TrVoVAvJE6b8cr2piTZei7aTn:95DyBSBCDVNRoTNoyvhrzav1F3V
  • TLSH
    T1D0C649F2654B73ACC29BCAF3A02C0444364699D112E949F3E5C47A74AFEFD99E214336
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral7behavioral8