Extracted

• • Target
    a23cae7fa65cec37c72fe1dbb646a5817efa53e460bef97a2f3b285e110fb95d
  • Size 260KB
  • SHA256 a23cae7fa65cec37c72fe1dbb646a5817efa53e460bef97a2f3b285e110fb95d
  • MD5 91cdadd008833d7528de001d78563cf1
  • SHA1 4b671a84389fa1ffc2efb90b74be703c10814cd8
  • SHA512 d3727b3c84eef5edf21c2468ad4062194bfa2a0becc52cc4dc32e9bb86f97cd46b0e744f917b9ce4ca7ae99907c164ff7e1e8c258da16a324b9dc624cdd23999
  • SSDEEP 3072:0Bw+8Q5tcuGDH3SsWP8gJKvbUqx9KQb4gQw8J3LGbv1/+PN6n+RSLWvKtsBR2L:0BVe1isWPPJAUqPvM3pEASp0R
  • TLSH
    T1C5448D5A32E1C837D24340728DD59BBEBFBEB5544D614E4323940B0CADB3DE196262AF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  backdoordefense_evasiondiscoveryvalleyrat_s2

  • Detects ValleyRAT payload

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Executes dropped EXE

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2