Extracted

• • Target
    Discount list and amount discount.exe
  • Size 174KB
  • SHA256 41d9c8f7662e76d62da7aac907d6419be76f60259241e16e7d8025ed4aa34d12
  • MD5 bb97150614bcb7fba7040f6674037605
  • SHA1 d3a6234a854886088eb29b21b26125b811a87768
  • SHA512 32d77ccc2aec0cda4ef0eadb39a787221d25d7e0f01dcfa2dd23e94b8843037f70bccc6ffa33537acd01c1a04c03a3b0d108a7799abd4d73420d8ff26e8d62c4
  • SSDEEP 3072:chlUYCVlFF4smO1RWUdESZhMiPx4DPmCJvo1aJBl0Zbln8D:chOY4tmOymfZJxAPj+sJsA
  • TLSH
    T1C4048C5673A824F6D4728178CA959A56F772B42B033183DF035486791F33BEA6E3E321
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebackdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistenceprivilege_escalationransomwarespywaretrojan

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Modifies visibility of file extensions in Explorer

    defense_evasion

  • Modifies visibility of hidden/system files in Explorer

    defense_evasion

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  behavioral1
• • Target
    wmicodegen.dll
  • Size 9KB
  • SHA256 9525e8f1e690a4d239d80b704c412dd31cd3fdcc54bce5a5fed5f389a988d9dd
  • MD5 7625681382c65ec8013781479e4832a8
  • SHA1 10391858a7e91b9f1cfa149251dab9e815ffbfd2
  • SHA512 80b016df90490e01ff71afa78e217b0e024813323bfc1568893cd101a71b27e369cfef1af5334c0bea8f8775686681c8d9351505e4ca451d0992fd9a3f2f7f3b
  • SSDEEP 192:hNR0WdCj8geSO6NHliq0CP7na/roS5H5P1aXBj7ioan:v9dvSF/iqbmjHEx5
  • TLSH
    T13E124D07F49160FDCC27D3B543876036E6B5BC0DA971AA1EDF921B2135E1A10AB3DA8D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistenceprivilege_escalationransomwareadwarespyware

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral2behavioral3