valleyrat_s2 | AEA4129A13864B196B8BF17CE9190884[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
AEA4129A13864B196B8BF17CE9190884.dll
Size 246KB
Sample260620-eyjk3set6x
SHA256 66c2a3817bf0639b0e39dbe75f906e5f9a571a4d63e454c6bd6cbf11243e5bcb
MD5 aea4129a13864b196b8bf17ce9190884
SHA1 be03579cd9196ab5cadb04e28b35ff431444a9f7
SHA512 b9398221bbba0f13812af1921baa1bf609a426559d1e3cab2e2dda6da147fb9ba20d736b31addffc4d46fce2c08f929c4b97a73844761c92b21e60c3d594651c
SSDEEP 6144:On8K25SLDS5iAbT7uw3YjXdUdnpTxBYtwcuSpzxABRM:GR25D5iuuw3eUdnpTxBYacuSpz
TLSH
T183348C217650C432E9DB0534C5BB8B760AADB8320755D4CFA7E44A7E1E723D2EA3538B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor valleyrat_s2

Malware Config

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects ValleyRAT payload 1 IoCs

resource	yara_rule
sample	family_valleyrat_stage_2_v2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AEA4129A13864B196B8BF17CE9190884.dll

File Explorer

AEA4129A13864B196B8BF17CE9190884.dll

.dll 246KB

AEA4129A13864B196B8BF17CE9190884.dll

IMPHASH f0e23b81c79b122387dbb66564f1f15f
SHA256 66c2a3817bf0639b0e39dbe75f906e5f9a571a4d63e454c6bd6cbf11243e5bcb
MD5 aea4129a13864b196b8bf17ce9190884
SHA1 be03579cd9196ab5cadb04e28b35ff431444a9f7
SHA512 b9398221bbba0f13812af1921baa1bf609a426559d1e3cab2e2dda6da147fb9ba20d736b31addffc4d46fce2c08f929c4b97a73844761c92b21e60c3d594651c
SSDEEP 6144:On8K25SLDS5iAbT7uw3YjXdUdnpTxBYtwcuSpzxABRM:GR25D5iuuw3eUdnpTxBYacuSpz
TLSH
T183348C217650C432E9DB0534C5BB8B760AADB8320755D4CFA7E44A7E1E723D2EA3538B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects ValleyRAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

90594

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCommandLineW GetThreadContext CreateMutexW SetThreadContext GetDriveTypeW FreeLibrary CreateProcessW GetCurrentProcess GetLogicalDriveStringsW GetModuleHandleW GetTickCount GetProcessHeap CreateRemoteThread WriteFile OpenProcess GlobalAlloc GetSystemDirectoryW LoadLibraryW GetLocaleInfoW GetConsoleWindow GetVersionExW GetFileAttributesA GetExitCodeProcess CreateProcessA GetModuleFileNameW GetSystemDirectoryA CreateFileW lstrcmpW MultiByteToWideChar GetStartupInfoW GetProcAddress VirtualProtectEx VirtualAllocEx GlobalFree GetLocalTime LoadLibraryA Process32FirstW GetProcessId LocalAlloc GlobalMemoryStatusEx QueryDosDeviceW GetSystemInfo GetModuleFileNameA Process32NextW ExitProcess GetModuleHandleA lstrcatW CreateToolhelp32Snapshot GetDiskFreeSpaceExW GetCurrentProcessId LocalFree WriteProcessMemory ResumeThread lstrcpyW GlobalSize GlobalLock GetFileAttributesW GetCurrentThreadId ExpandEnvironmentStringsW IsBadReadPtr VirtualProtect SetUnhandledExceptionFilter CreateThread GetFileSize SetFilePointer ReleaseMutex DeleteFileW SetEnvironmentVariableA CompareStringW FlushFileBuffers WriteConsoleW SetStdHandle GetConsoleMode GetConsoleCP IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetFileType SetHandleCount GetTimeZoneInformation IsValidCodePage GetOEMCP CreateWaitableTimerW SetWaitableTimer TryEnterCriticalSection CancelIo CreateEventW ResetEvent InterlockedExchange lstrlenW WideCharToMultiByte GetNativeSystemInfo SetLastError lstrcmpiW SwitchToThread VirtualFree CloseHandle GetLastError CreateEventA Sleep SetEvent WaitForSingleObject DeleteCriticalSection EnterCriticalSection HeapCreate LeaveCriticalSection HeapDestroy InitializeCriticalSectionAndSpinCount InterlockedCompareExchange HeapFree InterlockedDecrement InterlockedIncrement HeapAlloc GetACP TlsFree TlsSetValue TlsGetValue TlsAlloc GetStdHandle IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter TerminateProcess LCMapStringW RtlUnwind GetCPInfo RaiseException GetCommandLineA VirtualQuery GetSystemTimeAsFileTime ExitThread InitializeCriticalSection DecodePointer EncodePointer GetStringTypeW HeapSize HeapReAlloc VirtualAlloc GlobalUnlock

user32

GetDC DispatchMessageW PeekMessageW TranslateMessage MsgWaitForMultipleObjects IsWindowVisible GetLastInputInfo GetWindowTextW GetForegroundWindow wsprintfW EnumWindows GetSystemMetrics GetDesktopWindow ReleaseDC CloseClipboard ExitWindowsEx OpenClipboard GetClipboardData GetKeyState

gdi32

CreateDIBSection GetDeviceCaps StretchBlt GetDIBits SetDIBColorTable DeleteObject SelectObject CreateCompatibleDC CreateCompatibleBitmap GetObjectW SetStretchBltMode DeleteDC

advapi32

GetSidSubAuthorityCount GetSidSubAuthority CloseEventLog RegSetValueExW ClearEventLogW RegEnumValueW RegDeleteValueW RegCreateKeyW OpenEventLogW RegCloseKey AdjustTokenPrivileges RegEnumKeyExW GetCurrentHwProfileW RegOpenKeyExW LookupAccountSidW LookupPrivilegeValueW RegQueryInfoKeyW RegQueryValueExW GetTokenInformation OpenProcessToken

shell32

SHGetFolderPathW

ole32

CoCreateInstance CoUninitialize CoInitialize CreateStreamOnHGlobal GetHGlobalFromStream

oleaut32

SysAllocString SysStringLen SysFreeString

ws2_32

inet_ntoa WSAResetEvent WSAWaitForMultipleEvents WSAIoctl connect WSAStartup select htons setsockopt WSACleanup recv socket closesocket gethostbyname send WSACloseEvent WSAGetLastError WSAEnumNetworkEvents WSAEventSelect shutdown WSACreateEvent gethostname WSASetLastError

winmm

timeGetTime

gdiplus

GdipGetImageHeight GdipFree GdipSaveImageToStream GdiplusShutdown GdiplusStartup GdipGetImageWidth GdipCloneImage GdipBitmapLockBits GdipGetImagePaletteSize GdipGetImageEncoders GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipGetImageEncodersSize GdipAlloc GdipDrawImageI GdipBitmapUnlockBits GdipGetImageGraphicsContext GdipDeleteGraphics GdipCreateBitmapFromScan0 GdipGetImagePixelFormat GdipCreateBitmapFromStream GdipGetImagePalette

dxgi

CreateDXGIFactory

psapi

GetProcessImageFileNameW

dinput8

DirectInput8Create