valleyrat_s2 | 37fe2d07d360b2e7d66f1dcbc8aed5794528c0614c943[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
37fe2d07d360b2e7d66f1dcbc8aed5794528c0614c943.exe
Size 130KB
Sample250816-jsfdpabp4y
SHA256 37fe2d07d360b2e7d66f1dcbc8aed5794528c0614c943c77214df166cb503a5d
MD5 dcb41ddef5232d8a87ccdf713aca8392
SHA1 af08ba9defcd1a9eec15511cbe290867371258a1
SHA512 dc2b5e6a4bf6e1c286f89b74e4feedf16bc8f9a34368cbe9da23db39b3674ce1f0742f295f2439dc469f61ba42ff3d7ac9727d256131b685e0929a7d5a2d04c7
SSDEEP 3072:IO55k/y59Aj+BMTYlgEQnB+Y+pek7+3OrFZeUqe6o/:IO5n5956TYZQnB+Dpekyyqm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

valleyrat_s2

Malware Config

Extracted

Family

valleyrat_s2

Version

154.91.180.194:8080
154.91.180.194:90
127.0.0.1:80

Attributes

campaign_date
2025. 8.16

Signatures

Valleyrat_s2 family
valleyrat_s2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
37fe2d07d360b2e7d66f1dcbc8aed5794528c0614c943.exe

File Explorer

37fe2d07d360b2e7d66f1dcbc8aed5794528c0614c943.exe

.exe 130KB

37fe2d07d360b2e7d66f1dcbc8aed5794528c0614c943.exe

IMPHASH fb51ede541a9ad63bf23d302e319d2a0
SHA256 37fe2d07d360b2e7d66f1dcbc8aed5794528c0614c943c77214df166cb503a5d
MD5 dcb41ddef5232d8a87ccdf713aca8392
SHA1 af08ba9defcd1a9eec15511cbe290867371258a1
SHA512 dc2b5e6a4bf6e1c286f89b74e4feedf16bc8f9a34368cbe9da23db39b3674ce1f0742f295f2439dc469f61ba42ff3d7ac9727d256131b685e0929a7d5a2d04c7
SSDEEP 3072:IO55k/y59Aj+BMTYlgEQnB+Y+pek7+3OrFZeUqe6o/:IO5n5956TYZQnB+Dpekyyqm
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39540

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

HeapCreate EnterCriticalSection DeleteCriticalSection WaitForSingleObject SetEvent Sleep CreateEventA GetLastError CloseHandle GetCurrentThreadId SwitchToThread SetLastError WideCharToMultiByte lstrlenW ResetEvent CreateEventW CancelIo TryEnterCriticalSection SetWaitableTimer CreateWaitableTimerW GetThreadContext SetThreadContext LeaveCriticalSection GetExitCodeProcess CreateProcessA GetSystemDirectoryA VirtualAllocEx WriteProcessMemory ResumeThread FreeLibrary SetUnhandledExceptionFilter GetCurrentProcess LoadLibraryW GetConsoleWindow CreateFileW GetProcAddress GetLocalTime IsDebuggerPresent GetCurrentProcessId CreateThread LCMapStringW WriteConsoleW SetStdHandle GetStringTypeW MultiByteToWideChar HeapDestroy InitializeCriticalSectionAndSpinCount HeapFree HeapAlloc VirtualAlloc OpenProcess VirtualFree IsValidCodePage GetOEMCP GetACP GetCPInfo GetConsoleMode FlushFileBuffers GetConsoleCP SetFilePointer GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter GetStartupInfoW GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwindEx FlsAlloc FlsFree FlsSetValue FlsGetValue HeapReAlloc HeapSize GetProcessHeap ExitThread DecodePointer EncodePointer GetCommandLineW RaiseException RtlPcToFileHeader TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext HeapSetInformation GetVersion GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameW

user32

DispatchMessageW PostThreadMessageA PeekMessageW TranslateMessage MsgWaitForMultipleObjects ShowWindow GetInputState wsprintfW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteValueW RegQueryValueExW RegCreateKeyW RegSetValueExW

ws2_32

WSAWaitForMultipleEvents WSAIoctl connect WSAStartup select WSAResetEvent setsockopt recv socket closesocket gethostbyname send WSASetLastError WSACreateEvent shutdown WSAEventSelect WSAEnumNetworkEvents WSAGetLastError WSACloseEvent htons WSACleanup

winmm

timeGetTime