Extracted

• • Target
    2dbf556ed086f024f533e22c30d45e89.exe
  • Size 50.9MB
  • SHA256 3f803bafb2041916f177b065368c79ebce5e99c92fe1f4cf32b68c700aaba086
  • MD5 2dbf556ed086f024f533e22c30d45e89
  • SHA1 7c0d91f3d3b03ea076368c432e69a98f3484e0d4
  • SHA512 de3e375c913b675712a738d08874a23f17d15ca616e9a82c4ad8cf87c5f4215b5f9801524312169d197f4c2cd690d3d76dfaac4326325062253f4e4dbe90deb9
  • SSDEEP 1572864:rKNTrcxVxhV0mOxHzOB7GHGqOTydSzgBVoDpnsBj+:OVW0lTHG5TydSzGeFn2+
  • TLSH
    T154C73353A5BE962DF121657AC14F93CCFEA1B82D587FB438D508BC082233392A76D54E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  bootkitdefense_evasiondiscoverypersistencebackdoorvalleyrat_s2

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2
• • Target
    $PLUGINSDIR/System.dll
  • Size 25KB
  • SHA256 c7dd8cc8323e295b8821b0e320de208a7e20c068a8be8d03857520451ce9ded7
  • MD5 4abf19a47044ec746aa8c600f0bc149f
  • SHA1 69da1e4f654b044d7b3c845c12a07c988bf26eb8
  • SHA512 65727cbe3f03e0dceba06d206054e60adba321d29159b4bfb690c30b2ccd1a0a05a08c2aa50ac270fcd28557f4b482f492c36b0d7b7b980b477cd8971559610e
  • SSDEEP 384:jZ2pfUx9eVLwDKO9XYD/isN7lCEjgwMU/ktKi+R45Duwomq8pqdDvH81Q:jr96YIrx7lC7vU/kaG9uLmCdb
  • TLSH
    T1DEB24C07F38398BFC51BC17186EF5772AA32BE211B616F6F1220F5756E24EA0871DA14
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    $PLUGINSDIR/nsDialogs.dll
  • Size 14KB
  • SHA256 a0a6431feb4e09018d99acdc02f2139fbacd68420b0f84d4b22a9e091aaac707
  • MD5 48452d7f73a0e73b62a16b4c88068a60
  • SHA1 ef5a3edd25cf3cf664e93c38fbe9034ce652d117
  • SHA512 83dae4699678c2eb245bb3a5758b9decdae308042bf50a36266222a9c20f197503baad9f58f2522c6bfe32ad62b8af6ab6b8f99f2e51b72383f6c50d4d699274
  • SSDEEP 192:PZWhF6MuqMgfdPvg/YWkNLiY8vSKXS6Hn5gIIblaks8NHAHPEdeqe4KFz0:hWh4MFv1w/YWCLXASKi6nAlHJAl4KW
  • TLSH
    T13852191B7B42962ACD0AE374D5EF573322F3F4551138370E0669DB49BFE1660DA39288
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    Uninst000.exe
  • Size 17.0MB
  • SHA256 5ccb093b750f727bf6b90729012771e5a5fc1923a1e58656910a80bc67bbeb62
  • MD5 4022b5a95d519f5b81aefb9fd20d7a44
  • SHA1 fec17bd98fc2ca53041fff123be6b4befecc5cd6
  • SHA512 d6478b41cee80f92f366048331670a10b114dc7236353b3ba85e34ce4edba24ca1dbb8d9e284c646640deebb69baf6edc5343da2a84a8e9c6326ef91bd29e97d
  • SSDEEP 393216:a1UKc3ui2Jigd8ElA6pveSXPIYFNuEPW4vCBi+DBBZb1ddjHEWqrsC:aUKCPM6ElA6pve466W46M+VBZLdjkBrd
  • TLSH
    T12407335377C5D173D2A21031455A9BA85FBBF831AA66AD07A3C12F1E8B706C2CE0674F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  6^/10

  bootkitdefense_evasiondiscoverypersistence

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral7behavioral8
• • Target
    VC_redist.x64.exe
  • Size 17.9MB
  • SHA256 90e48ade404e4576d023abfa374f323555f233982a8805ea9ac63dca9491a16b
  • MD5 bb2063bbfe319d17b18d8f506efb9b8d
  • SHA1 6e6012844d636aa7b28067554d6fd0bfda393097
  • SHA512 3dece58f72ddcb2574c33bd4cc41fde8b4304c5bc0a9e6a0cf9eb9e095a389f5659462475ab366a6d8a6820999fd5f03ab17f865c921c481632b236a05ee5b35
  • SSDEEP 393216:P6C6pMxhgFCXoBX7Zw9XI3+8pQT4zLk5yn2mZfkjhQEHUf/:P6C6OxOFCXop7Zw943+S3kgnfaUf/
  • TLSH
    T106173333A4224177F7B104B3A528E3703E7CB3186B5999B9C7C8FD483A64491A6BF617
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  4^/10

  discovery
  behavioral10behavioral9
• • Target
    VC_redist.x86.exe
  • Size 6.7MB
  • SHA256 b6ab675f0a27e6600f9726e75dea08d99c15f8ea4b842a2a1d988fa9529d39b9
  • MD5 053c6abdfd2f448b58b57dfd23c49e39
  • SHA1 50e5c7425509c359074b6e7483d2781b4d305b4e
  • SHA512 58a32cd725fb36273e6576c0bd76b8a962f0e5411580cc50aeaabe80a75becb8fed43b018b2d4bd483e6910bedfaa3491dfba8eddc9e96855db851eeef3f5cdc
  • SSDEEP 196608:rLZUAOiYv1lQ9SKu1Yf1Fszdcno1PRKF1EvBmtrN:xU94Syf1FodcaRwE47
  • TLSH
    T1E0662332A4B54032F7F50177BA2891303D3CE728276198ADE7C8AD1D79688D2B7F7256
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  4^/10

  discovery
  behavioral11behavioral12
• • Target
    aacenc_utils.h
  • Size 7KB
  • SHA256 f17016ce1e335a0a5fba9b95a3272fb2f69c055168a7c558df6bc208ea575cf4
  • MD5 bd89c2a91939d0adf53b820bf68901e2
  • SHA1 f3cd9235df895b5ac8e4d11136c3762b812023ec
  • SHA512 9b1e1a0e31c45809f312104daecc66ccead3477e851d9114fe4f83661fca73c4085d90cdb78aeafb0fdbb5fff7ef7aaaf24f35a5bafa12eda314f1b228f28f14
  • SSDEEP 192:QguA3VK4w/iQ2xIrx2flhky1mBi/aLgniQv7Ey5QnEi2tGvJReRXg:FuA4zxaD55P5nM0Rw
  • TLSH
    T184F1F7156AC24A3829436D6C6A4F91A4F01F41BB73F99D80B41CD2A13F49CB863F5EDA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral13behavioral14
• • Target
    aarch64/pngdsp_neon.S
  • Size 10KB
  • SHA256 008756c716ba48937ee2d6b7542f9b19c1055bbf285c2106acf276f64b6e0c67
  • MD5 4d1a2d35a8499342bf07ffd23d7cca08
  • SHA1 0ff0ecbd2bbdc737fe393ad39bc1ef6c2d17daad
  • SHA512 a1d014764d807424f99760b6f4503dd92fb6f5121e7609f20925cabdbc13ed121c7d3b8109612ac637a9713c4157ee77fd8fde15605eb95fad2db40915655e43
  • SSDEEP 192:tuA+8FZ1crTVKLZ9wJWcg/pBh9HMe6nrDrRRKgW8q5GWkuBjzCpDPMPD8MGMi6oL:tuA+8D1wJgpP9iV25GWzBn+CZrDgEg
  • TLSH
    T13E220192B4A69EBAAC0E93394A632D9B4110B4036314C47C730FD7DD5F172A993EE5E1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral15behavioral16
• • Target
    avcodec.h
  • Size 107KB
  • SHA256 909f5c2fe7caf26601c39cd96acbc6f58f49ec5a78914d2e5b524a3fc2571afc
  • MD5 357c8ca37e09032a4962d358bea43d14
  • SHA1 6f3f1ab3cc2580073ae0ac6f8f8d84157ff29b4f
  • SHA512 e1c993776cfd9bd68c66b750435885e955c70e25a826c8f891b7675c8330ae3486090507141b1d9c62b2555f76615f7de45f56fbb37bcaec92118bcc5c3bc268
  • SSDEEP 1536:yW5YqmrQE9hYD/rWupTqu1fUmuJ2IylIslLoKxx62HMws6bkdvDOWo:yW5YR0rKJ2IyvoCRsL6
  • TLSH
    T170B3741766D512221B5208B1274A9AE5D31DF13FB2B155D8386E02BC2F84F7693B2FEC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  5^/10

  execution

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral17behavioral18
• • Target
    cinepakenc.c
  • Size 48KB
  • SHA256 664c4b332da078e384805d024a0d611ae80fd80b365e726f01da1433d430f98b
  • MD5 921fe0addcc1803e37375ea1bdd569d4
  • SHA1 0cca3741b384581eee5694af5747df927f6eea9e
  • SHA512 7d92e4e77dd653a8c59ef45030e8cbefd043ff8e16bcf2492e20049455a45f287fcf287f583ee76c87af64ff379aa2607d01aa548b6f6353f09d94ea554f2754
  • SSDEEP 768:PKEXYhye5FhfR4gpW1deZyL9btLAyw8t5ZTQev1GVQX1c1:PKEsye5FhfR4gpudeZyL9bC8bZTQe1C
  • TLSH
    T1D223856BD1D21AE63BA394394BDF9000522EA4737545FE04BC5D53A03F850B9A3B1FBA
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  5^/10

  execution

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral19behavioral20
• • Target
    elbg.c
  • Size 17KB
  • SHA256 720e1ad978c0546b52aee8e3485d548dda148cffced48e9ac292ad2ac9dd9a80
  • MD5 3331bec867b09adde6b29c332eca74df
  • SHA1 7ebddd34e1019dcb708f33a6c573a3418390aba5
  • SHA512 93e60f68a4d1f6b2e95460e5222b92a4d88338cb9a47200ad60d699779855d13fdf47e2758c7cfb4a48ebb96f130a2318dd9953cd37399ad62b990cca590e1e9
  • SSDEEP 384:PuAE+9nDGmntM9nk+5vXiC59MRNNNZg7z0:PuAEcnntMxn9MTNNZuz0
  • TLSH
    T1F98295410B9192AA666A78F23BCE70A5215EC46335E0F853FC7C53140F89274EBFE798
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  5^/10

  execution

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral21behavioral22
• • Target
    h264_cavlc.c
  • Size 42KB
  • SHA256 a78d92c371c8ae828fce8843f1a12516f80214647937187076997f71039c3700
  • MD5 279fc240ea65619eaa6341217d73683b
  • SHA1 3f32185ef9a15979d21f0ced6e33b88d7fd8f4df
  • SHA512 d7c486c543d5ac989654da825a52f1c590228076c26bd778e74e32c9f994dcbe9f3de9a090c9b1e02f1bb26a5a254f9f3ac88ae20819cb0f69e390df3594c4ed
  • SSDEEP 768:7uAieSJ1lLYbhlV5/eAcYagUQXRaRMcRuR8tFHp5JX4QzE18EfhT1C7EhRWVRyRC:7seSJ1lLYbxpwYagUQXRaRMcRuR8tFHF
  • TLSH
    T1D113726915A61A9925DBDC3C2BCF0C066129D11720FCFC97BDAC06584FAE41DA3F9F60
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  5^/10

  execution

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral23behavioral24
• • Target
    intrax8.c
  • Size 24KB
  • SHA256 e0d9f428e6ccad574616caeb32019481fe6e02b721b71f526a7871bbe7c63337
  • MD5 bbccef9fb5a7799302527ebc226635dc
  • SHA1 90cb6f4a0ce930da9a500ffa28d351c82885cdaa
  • SHA512 0187c9408ee3d604ab2883490c2421c6d22c4b91c188ab9072e6a68c5bf883cecc1bae7b41249ee92b8f917a5e4631cff5a89716ca5121f8816f436a2ea7d490
  • SSDEEP 384:quA3fO26BQMtJTqz24CtVgOPMuABDQPvQed/LnbmlxFsb0LlXO1czbZ:quA3f9q0BDQPYelLqqgXO1czbZ
  • TLSH
    T126B2622016E338663833D43C9BCE60501665991B2ADAF892BE5D47953F6A13C037FFE9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  5^/10

  execution

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral25behavioral26
• • Target
    intrax8.h
  • Size 3KB
  • SHA256 969628e89a1fd45f0923207fc98d7867c961fb769fda19e8d287b430b853a4ad
  • MD5 f03dba54d6d7524b9d7fedaec01a94b1
  • SHA1 d9a446e138bf1b5b3037112b87c348dd52b459a4
  • SHA512 00e343f4a771e2cacf208f0f73134dcbb0af4973b60c6867107dd2f64ccd7a97b8fed44cc7be99122635cb539f39ffb6ede7e3bcb3633a559c1ed21abf634f12
  • TLSH
    T15761632B39A60353A2441561ABC670D1221491B773E3F0E0759DAAAF2FCE47C63B6FD1
  • MD5 SHA1 SHA512 TLSH

  Score

  5^/10

  execution

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral27behavioral28
• • Target
    mfenc.c
  • Size 48KB
  • SHA256 3316376277521e352d91c90d12d64a5a527cd9f6c58d1ca9ad99f93909fe0b26
  • MD5 0b92094dc9f0b06643755c71ff7b7529
  • SHA1 aa5d132344f46fd20c7d88882780c84087165a17
  • SHA512 63ca20528748d10148dc6ede7bfb453d1881937d839cdf223def65b55f31dd26c17cec7920b2feecf8896de4c5501ab8178a40de1df5673b38fe6c739746b8f3
  • SSDEEP 384:quAi5FNR13aimA4HKhpwlmyjqLp7LnQYYdDfoRW9mG/U3zw7NQYJ+Qj:quA6RJaimLHm5LnMjoRWA1j8NQYvj
  • TLSH
    T16F23C52918E3513696A7643D77C7C40D6B1494AB4A89FE883CCD8A386FCC83966F4BD1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  5^/10

  execution

  • Executes a VBScript file via the Windows Script Host.

    execution
  behavioral29behavioral30
• • Target
    nvenc.c
  • Size 117KB
  • SHA256 463372174321a567cbcea4ea24d82844f01309bcf22a227037a4bb8b08957878
  • MD5 fc62d25092efa8c5453779f4447ad624
  • SHA1 c8c5a7e42a1a9826798129bf85e688db544b482b
  • SHA512 9ce48ae7f015f7e71d8b887d7a9911227632f3f6331b3c6a885e9dba938c04fc1c5bc44b1f1244a8e33e0804f7fcf3f365d08911809c17eb4b6a096f0cf0348a
  • SSDEEP 1536:o8dwJRJWwt1s3QOHiZkhdlUTtdN0puoEzyHatr8sBdMvuReTWMEMlVBrqwT7Xvm/:o8dwowIj6FGr1zSSR2
  • TLSH
    T1C1C3E79669EFA26A6A5375781BC7C50D839716833A08FD447ECED6002FCC87582B1FB4
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral31behavioral32