valleyrat_s2 | 21169e5a0b4a1d0b7bac5b335139c7de57b33229fd26a383e0948938a76d5863

General

Target
21169e5a0b4a1d0b7bac5b335139c7de57b33229fd26a383e0948938a76d5863.exe
Size 1.9MB
Sample260706-e2wptadv5n
SHA256 21169e5a0b4a1d0b7bac5b335139c7de57b33229fd26a383e0948938a76d5863
MD5 702f732f25e128d0419c40d95cfd9e79
SHA1 5dfaa76ef4b04a72af1dbcf2f39703059c53b0d1
SHA512 b92a50d2bbc6adebefcecb29059e8186d81695ac68127ab479bc96c70f3dc590b7d5845cdf8fa83e998aae52623531cc8374d8ee23ef6e090c235632fb74653e
SSDEEP 12288:7L6zPpxl0pNjMjMwBU3Vo29ANzUzv3IgNaSWYdU4881GNT0Qkb3NnX+SWm8dNgt8:7L0pxeLjb8GVnOTJ0SU1MzykDEXm9
TLSH
T1FD959324B9BA812DD037FFB83EDDF49EEDEB2A151544646B0142034B8A26AD0CF5B53D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

valleyrat_s2

Version

1.0

C2

154.12.19.70:22011
154.12.19.70:22012

Targets

- Target
  21169e5a0b4a1d0b7bac5b335139c7de57b33229fd26a383e0948938a76d5863.exe
- Size 1.9MB
- SHA256 21169e5a0b4a1d0b7bac5b335139c7de57b33229fd26a383e0948938a76d5863
- MD5 702f732f25e128d0419c40d95cfd9e79
- SHA1 5dfaa76ef4b04a72af1dbcf2f39703059c53b0d1
- SHA512 b92a50d2bbc6adebefcecb29059e8186d81695ac68127ab479bc96c70f3dc590b7d5845cdf8fa83e998aae52623531cc8374d8ee23ef6e090c235632fb74653e
- SSDEEP 12288:7L6zPpxl0pNjMjMwBU3Vo29ANzUzv3IgNaSWYdU4881GNT0Qkb3NnX+SWm8dNgt8:7L0pxeLjb8GVnOTJ0SU1MzykDEXm9
- TLSH
  T1FD959324B9BA812DD037FFB83EDDF49EEDEB2A151544646B0142034B8A26AD0CF5B53D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor credential_access defense_evasion discovery evasion valleyrat_s2 persistence privilege_escalation ransomware trojan
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Modifies firewall policy service
  defense_evasion
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Disables use of System Restore points
  defense_evasion
- Drops file in Drivers directory
- Modifies Windows Firewall
  defense_evasion
- Server Software Component: Terminal Services DLL
  persistence
- Boot or Logon Autostart Execution: LSASS Driver
  Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
  persistence credential_access
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  defense_evasion trojan
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2