valleyrat_s2 | 84473B78763E8B3AD68347174DFCF644[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
84473B78763E8B3AD68347174DFCF644.exe
Size 148KB
Sample260423-jkfpgset8z
SHA256 749c01f5ddf2911059eb795923b81fc605cbba51f3c683313253bf51e97960b0
MD5 84473b78763e8b3ad68347174dfcf644
SHA1 49d617d589d3acacb4de9a80bc8ded85e48e8467
SHA512 06adaf59d7778ad94768543209e701f865107b50008e41c6243aa0b2a1d42dc00714ac69e7bc26a7102b08703b9aee35cfd6aed55299539972a39732a1a1c054
SSDEEP 3072:wbxwRoe0/2/Qa52RltsA11W8o2zdpfw5MorHuhaNyUpFUJR38yt/tsTF4J:wyRor+/QOePsM82zPfwKIOhaxqFSuJ
TLSH
T1C8E37C2071C0C0B3C8B6553158B4EE769A3DF9701F245DEB63980BB99F342D29B39A67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor valleyrat_s2

Malware Config

Extracted

Family

valleyrat_s2

Version

124.156.133.46:1008
127.0.0.1:80

Attributes

campaign_date
2026. 4.13

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
84473B78763E8B3AD68347174DFCF644.exe

File Explorer

84473B78763E8B3AD68347174DFCF644.exe

.exe 148KB

84473B78763E8B3AD68347174DFCF644.exe

IMPHASH 95d95a460e8783695f0245e2dce92576
SHA256 749c01f5ddf2911059eb795923b81fc605cbba51f3c683313253bf51e97960b0
MD5 84473b78763e8b3ad68347174dfcf644
SHA1 49d617d589d3acacb4de9a80bc8ded85e48e8467
SHA512 06adaf59d7778ad94768543209e701f865107b50008e41c6243aa0b2a1d42dc00714ac69e7bc26a7102b08703b9aee35cfd6aed55299539972a39732a1a1c054
SSDEEP 3072:wbxwRoe0/2/Qa52RltsA11W8o2zdpfw5MorHuhaNyUpFUJR38yt/tsTF4J:wyRor+/QOePsM82zPfwKIOhaxqFSuJ
TLSH
T1C8E37C2071C0C0B3C8B6553158B4EE769A3DF9701F245DEB63980BB99F342D29B39A67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30701

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapAlloc DecodePointer HeapDestroy DeleteCriticalSection GetProcessHeap HeapCreate EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection WaitForSingleObject Sleep SetEvent CloseHandle CreateEventA GetCurrentThreadId SwitchToThread SetLastError CancelIo lstrlenW CreateEventW ResetEvent WideCharToMultiByte TryEnterCriticalSection SetWaitableTimer CreateWaitableTimerW WriteProcessMemory ResumeThread HeapReAlloc GetFileAttributesA OutputDebugStringW GetSystemDirectoryA GetThreadContext VirtualAllocEx CreateProcessA SetThreadContext GetExitCodeProcess GetCurrentProcess CreateFileW CancelWaitableTimer LoadLibraryW CreateThread GetLocalTime GetProcAddress GetCurrentProcessId FreeLibrary GetConsoleWindow IsDebuggerPresent SetUnhandledExceptionFilter GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetLastError HeapSize InitializeCriticalSectionEx VirtualAlloc VirtualFree OpenProcess HeapFree GetEnvironmentStringsW MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW WriteConsoleW FindClose LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwind EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetFileType

user32

ShowWindow TranslateMessage PeekMessageW DispatchMessageW MsgWaitForMultipleObjects wsprintfW GetInputState PostThreadMessageA

advapi32

RegSetValueExW RegOpenKeyExW RegCreateKeyW RegDeleteValueW RegQueryValueExW RegCloseKey

ws2_32

WSAIoctl closesocket select WSACleanup send socket connect recv htons setsockopt WSAGetLastError WSAEnumNetworkEvents WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSASetLastError WSACreateEvent WSACloseEvent shutdown WSAStartup gethostbyname

winmm

timeGetTime

Name

.text

Size

102KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

33KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

5KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

84473B78763E8B3AD68347174DFCF644.exe

kernel32

user32

advapi32

ws2_32

winmm

generic