valleyrat_s2 | _ea37cf74d52ae3a829b32b3c91f940132a649ec854b2d2377ef82c523fff7fe4[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
_ea37cf74d52ae3a829b32b3c91f940132a649ec854b2d2377ef82c523fff7fe4.dll
Size 211KB
Sample260630-e54vlaew5z
SHA256 ea37cf74d52ae3a829b32b3c91f940132a649ec854b2d2377ef82c523fff7fe4
MD5 4f46075552500da5b19b711285a5152d
SHA1 0fda1bfcc63a8198882a0bbfcfdc1e40bc001df8
SHA512 092c97f3c56fd836ca77a64cae7b8de6ba538831ff3404bf6316d9b0d9dc0813abcf9725392767ae1fd6f1de67f7250bab71eed48e8359e7b170197d8aca8683
SSDEEP 6144:n3WOArZU5HEl9YKmfeHvkZWNEbgN4YYYYE:3fA1U5HEl8eHvkZWNEHYYYY
TLSH
T1C3246B217680C13BC19B1A3196BF9FB618BCAA35176581CBB7904EB91E707D1FE3470A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor valleyrat_s2

Malware Config

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects ValleyRAT payload 1 IoCs

resource	yara_rule
sample	family_valleyrat_stage_2_v2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
_ea37cf74d52ae3a829b32b3c91f940132a649ec854b2d2377ef82c523fff7fe4.dll

File Explorer

_ea37cf74d52ae3a829b32b3c91f940132a649ec854b2d2377ef82c523fff7fe4.dll

.dll 211KB

_ea37cf74d52ae3a829b32b3c91f940132a649ec854b2d2377ef82c523fff7fe4.dll

IMPHASH 2cf88258b418fcd7a89902f001ed24cf
SHA256 ea37cf74d52ae3a829b32b3c91f940132a649ec854b2d2377ef82c523fff7fe4
MD5 4f46075552500da5b19b711285a5152d
SHA1 0fda1bfcc63a8198882a0bbfcfdc1e40bc001df8
SHA512 092c97f3c56fd836ca77a64cae7b8de6ba538831ff3404bf6316d9b0d9dc0813abcf9725392767ae1fd6f1de67f7250bab71eed48e8359e7b170197d8aca8683
SSDEEP 6144:n3WOArZU5HEl9YKmfeHvkZWNEbgN4YYYYE:3fA1U5HEl8eHvkZWNEHYYYY
TLSH
T1C3246B217680C13BC19B1A3196BF9FB618BCAA35176581CBB7904EB91E707D1FE3470A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Detects ValleyRAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

86802

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetCommandLineW GetThreadContext GetFileSize CreateMutexW SetThreadContext GetDriveTypeW FreeLibrary CreateProcessW GetCurrentProcess GetLogicalDriveStringsW GlobalLock GetModuleHandleW GetTickCount GetProcessHeap GetPrivateProfileStringW CreateRemoteThread WriteFile OpenProcess GlobalAlloc GetSystemDirectoryW LoadLibraryW GetLocaleInfoW GetConsoleWindow GetVersionExW GetFileAttributesA GetExitCodeProcess GetFileAttributesW CreateProcessA ReadFile GetModuleFileNameW GetSystemDirectoryA CreateFileW lstrcmpW MultiByteToWideChar GetStartupInfoW GlobalUnlock GetProcAddress VirtualProtectEx VirtualAllocEx GlobalFree GetLocalTime LoadLibraryA Process32FirstW GetProcessId LocalAlloc ExitProcess QueryDosDeviceW GetSystemInfo GetModuleFileNameA Process32NextW lstrcmpiW GetModuleHandleA lstrcatW CreateToolhelp32Snapshot GetDiskFreeSpaceExW GetCurrentProcessId LocalFree WriteProcessMemory lstrlenW lstrcpyW GlobalSize ExpandEnvironmentStringsW IsBadReadPtr VirtualProtect SetUnhandledExceptionFilter CreateThread SetFilePointer ReleaseMutex DeleteFileW SetEnvironmentVariableA CompareStringW FlushFileBuffers WriteConsoleW SetStdHandle GetConsoleMode GetConsoleCP RtlUnwind QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW GetFileType SetHandleCount GetTimeZoneInformation GetStringTypeW LockResource SizeofResource LoadResource FindResourceW FindResourceExW CreateWaitableTimerW SetWaitableTimer TryEnterCriticalSection CancelIo CreateEventW ResetEvent GlobalMemoryStatusEx InterlockedExchange Sleep WideCharToMultiByte GetNativeSystemInfo SetLastError VirtualFree SwitchToThread GetCurrentThreadId CloseHandle GetLastError CreateEventA SetEvent WaitForSingleObject DeleteCriticalSection EnterCriticalSection HeapCreate LeaveCriticalSection HeapDestroy InitializeCriticalSectionAndSpinCount InterlockedCompareExchange HeapFree InterlockedDecrement InterlockedIncrement HeapAlloc LCMapStringW IsValidCodePage GetOEMCP GetACP GetCPInfo TlsFree TlsSetValue TlsGetValue TlsAlloc GetStdHandle IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter TerminateProcess GetCommandLineA VirtualQuery GetSystemTimeAsFileTime EncodePointer DecodePointer ExitThread HeapSize HeapReAlloc RaiseException VirtualAlloc ResumeThread

user32

ReleaseDC DispatchMessageW PeekMessageW TranslateMessage MsgWaitForMultipleObjects IsWindowVisible OpenClipboard GetLastInputInfo GetWindowTextW GetClipboardData GetForegroundWindow wsprintfW EnumWindows CloseClipboard GetSystemMetrics GetDesktopWindow ExitWindowsEx GetDC GetKeyState

gdi32

CreateDIBSection GetDeviceCaps StretchBlt GetDIBits SetDIBColorTable DeleteObject SelectObject CreateCompatibleDC CreateCompatibleBitmap GetObjectW SetStretchBltMode DeleteDC

advapi32

CryptDestroyHash CryptAcquireContextW CloseEventLog ClearEventLogW RegEnumValueW RegDeleteValueW RegQueryInfoKeyW RegCreateKeyW OpenEventLogW RegSetValueExW RegCloseKey AdjustTokenPrivileges GetCurrentHwProfileW RegOpenKeyExW LookupAccountSidW LookupPrivilegeValueW RegQueryValueExW GetTokenInformation GetSidSubAuthorityCount GetSidSubAuthority OpenProcessToken CryptHashData CryptCreateHash CryptReleaseContext CryptGetHashParam

shell32

SHGetFolderPathW

ole32

CoCreateInstance CoUninitialize CoInitialize CreateStreamOnHGlobal GetHGlobalFromStream

oleaut32

SysAllocString SysStringLen SysFreeString

ws2_32

gethostname inet_ntoa WSACloseEvent WSAWaitForMultipleEvents WSAIoctl connect WSAStartup select htons setsockopt WSACleanup recv socket closesocket gethostbyname send WSAGetLastError WSAEnumNetworkEvents WSAEventSelect shutdown WSACreateEvent WSASetLastError WSAResetEvent

winmm

timeGetTime

gdiplus

GdipGetImageHeight GdipFree GdipSaveImageToStream GdiplusShutdown GdiplusStartup GdipGetImageWidth GdipCloneImage GdipBitmapLockBits GdipGetImagePaletteSize GdipGetImageEncoders GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipGetImageEncodersSize GdipAlloc GdipDrawImageI GdipBitmapUnlockBits GdipGetImageGraphicsContext GdipDeleteGraphics GdipCreateBitmapFromScan0 GdipGetImagePixelFormat GdipCreateBitmapFromStream GdipGetImagePalette

wininet

InternetOpenUrlA InternetReadFile InternetSetOptionW InternetOpenA InternetCloseHandle

dxgi

CreateDXGIFactory

psapi

GetProcessImageFileNameW

dinput8

DirectInput8Create