Extracted

• • Target
    Financial Statistical Reports_1435.iso
  • Size 984KB
  • SHA256 5ba583585e4fe56cdee37569ffd4702d908035c8bf9b8991c69143cc7a665f63
  • MD5 7f275c951df49d42b0ab11a73a2b6130
  • SHA1 061f54faa107a713c184b7322df05227ba1c7d7e
  • SHA512 bb450ca99dcee8a3cb226217720ab2aed2fb151bab560d4c8f1a0a0f468b399617a165e703c9c44fe76023282a65531f561db66c78348edd9ff51156ca7e12e4
  • SSDEEP 12288:MKTr92i/qCDrWz88MsbP0cVt0ogGVuG8FHHOrWTNEFTyEgRCzBd+fZ8OMO3J:hVyuWg8MkV+7ouBFHHXTNE1oCdd+f+p
  • TLSH
    T14025F046F3A419F5D0ABC138C9628516E772BC9A0775CBCF33A8466A2F232D14E3D752
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  adwarebackdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistenceprivilege_escalationransomwarespyware

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Executes dropped EXE

  • Loads dropped DLL

  • Modifies system executable filetype association

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • Probable phishing domain

  • Suspicious use of SetThreadContext

  behavioral1behavioral2