valleyrat_s2 | 0e6497151c262bfaadf3838ec640c87f[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
0e6497151c262bfaadf3838ec640c87f.exe
Size 130KB
Sample260316-e4z51scv7x
SHA256 b70588f2def66b443de23193b91b9fe01796232e1cceedeeea23a32f10094e76
MD5 0e6497151c262bfaadf3838ec640c87f
SHA1 70d2180b21e420d413095ee47d4285b83ad3b44c
SHA512 11f321b275de99da0a4727528e5bc64d8e4995fc3c286bb02764a290690f498bb6454e5f252a7641ba5b3ec641d1f97b2e1ddb5e4c8d45a3bad8a99ef1840db5
SSDEEP 3072:wJvr9PP8JYCBwsioRTwQJvMB2OgtEYdZUbdFz56U1e6w4:wJv5UJYU40TwkMB2OgtEsZK9+4
TLSH
T1A1D36C4B33A450F5D4A7C378C9A25A06E7B378661731A7CF13A4866A6F137D0AD3A331
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

valleyrat_s2

Malware Config

Extracted

Family

valleyrat_s2

Version

8.222.196.241:2006
8.222.196.241:2007
127.0.0.1:80

Attributes

campaign_date
2026. 3. 8

Signatures

Valleyrat_s2 family
valleyrat_s2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e6497151c262bfaadf3838ec640c87f.exe

File Explorer

0e6497151c262bfaadf3838ec640c87f.exe

.exe 130KB

0e6497151c262bfaadf3838ec640c87f.exe

IMPHASH 2f4c92a36f0eb35d81a44e3422e1082b
SHA256 b70588f2def66b443de23193b91b9fe01796232e1cceedeeea23a32f10094e76
MD5 0e6497151c262bfaadf3838ec640c87f
SHA1 70d2180b21e420d413095ee47d4285b83ad3b44c
SHA512 11f321b275de99da0a4727528e5bc64d8e4995fc3c286bb02764a290690f498bb6454e5f252a7641ba5b3ec641d1f97b2e1ddb5e4c8d45a3bad8a99ef1840db5
SSDEEP 3072:wJvr9PP8JYCBwsioRTwQJvMB2OgtEYdZUbdFz56U1e6w4:wJv5UJYU40TwkMB2OgtEsZK9+4
TLSH
T1A1D36C4B33A450F5D4A7C378C9A25A06E7B378661731A7CF13A4866A6F137D0AD3A331
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39524

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

HeapCreate EnterCriticalSection DeleteCriticalSection WaitForSingleObject SetEvent Sleep CreateEventA GetLastError CloseHandle GetCurrentThreadId SwitchToThread SetLastError WideCharToMultiByte lstrlenW ResetEvent CreateEventW CancelIo TryEnterCriticalSection SetWaitableTimer CreateWaitableTimerW GetThreadContext SetThreadContext LeaveCriticalSection GetExitCodeProcess CreateProcessA GetSystemDirectoryA GetProcAddress VirtualAllocEx GetModuleHandleA ResumeThread FreeLibrary SetUnhandledExceptionFilter GetCurrentProcess LoadLibraryW GetConsoleWindow CreateFileW GetLocalTime IsDebuggerPresent GetCurrentProcessId CreateThread LCMapStringW WriteConsoleW SetStdHandle GetStringTypeW MultiByteToWideChar HeapDestroy InitializeCriticalSectionAndSpinCount HeapFree HeapAlloc VirtualAlloc OpenProcess VirtualFree IsValidCodePage GetOEMCP GetACP GetCPInfo GetConsoleMode FlushFileBuffers GetConsoleCP SetFilePointer GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter GetStartupInfoW GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwindEx FlsAlloc FlsFree FlsSetValue FlsGetValue HeapReAlloc HeapSize GetProcessHeap ExitThread DecodePointer EncodePointer GetCommandLineW RaiseException RtlPcToFileHeader TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext HeapSetInformation GetVersion GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameW

user32

DispatchMessageW PostThreadMessageA PeekMessageW TranslateMessage MsgWaitForMultipleObjects ShowWindow GetInputState wsprintfW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteValueW RegQueryValueExW RegCreateKeyW RegSetValueExW

ws2_32

WSAWaitForMultipleEvents WSAIoctl connect WSAStartup select WSAResetEvent setsockopt recv socket closesocket gethostbyname send WSASetLastError WSACreateEvent shutdown WSAEventSelect WSAEnumNetworkEvents WSAGetLastError WSACloseEvent htons WSACleanup

winmm

timeGetTime