Extracted

• • Target
    final.bin
  • Size 183KB
  • SHA256 44a0e506ace77d147961f568d910130f1e024c1939c0636f1fe57743a81c401c
  • MD5 0e0fbf00d7807a39115999882955244d
  • SHA1 6765d8a29b7941f20a5c83ca4727b41b87abb052
  • SHA512 545431c77a675a2a4408f3bac47eb09cd2d2544b21870668a3a0fc65e3cd763a11a554bd3a23c4e2070d36ff02b5f115deacf019680fecf01011959cee02952e
  • SSDEEP 3072:6DsqZ/jNozWPf2tOlTTqNr0j9xqnN76WyOYe1xOZ+RBfXupwpFYqdr/a/d:6HNozWH5TTXoN7R5YeKc+bd
  • TLSH
    T16F045A46B3A500B6ED6382788D634A46E77274554370ABCF576083BADF2B7D07A39321
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistenceprivilege_escalationransomwarespywarestealer

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1