valleyrat_s2 | 77a03e8d48a0dca9c736d04dc6a6ab9aa74dc7445bea203937506da1edc03b44

Sharing

Copy URL Twitter E-mail

General

Target
18072026_0927_Tax-Number635863.img.zip
Size 3.0MB
Sample260718-le15cafs3q
SHA256 77a03e8d48a0dca9c736d04dc6a6ab9aa74dc7445bea203937506da1edc03b44
MD5 1f48a5e4741e3d18ada769c117c09035
SHA1 41f62192f7781834bbc5f7c0a01dcd66e6a35c1b
SHA512 e6888198842187c54140a035fc646e1bbf030049183949a9d5e5cdec006f94fe3015053227bfc9de3a3753d892c4b4a2395e8823348a8d89888dfc89774b1917
SSDEEP 49152:xDI5CfSXHMU9H/Hy6dDtNs2RataaJ+g5MiYJknpCWW3zAIHP9:xk5YM9Hvy6dvsEataaLbckHW38IHP9
TLSH
T180E5023AFB383180F55C6EF0BB419A9857EEEED656DCCF5426803E064CF62905689C36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

valleyrat_s2

Version

yk.ggdy.com:8003
yk.ggdy.com:80
103.59.103.30:8888
103.59.103.30:6666
127.0.0.1:80

Attributes

campaign_date
2023. 6.30

Targets

- Target
  Tax-Number635863.exe
- Size 24KB
- SHA256 a5fad3d78a6c7592176718cb852aa46839dc72d131400f00e534dcb2b1d525ee
- MD5 0540b916f89547317c69e486bdc6d225
- SHA1 a6f67c2562184b92b1d3635f82980d90bcf2f04e
- SHA512 772be307269ef929f0f013cd9e714b6530dd78beb36bdc44d5cba0ac82d0b1ffda82119950c1aaf01e486536d63f167c76e6cefd52eca1840f440db0663f907d
- SSDEEP 384:8wV/wByFJpk5A5l9F7hbjvTy8RbmL4nNydC:lTF3k5CtbH5AL
- TLSH
  T16CB27C67CAA00CCAEE1B8AB0B4E8562BED31B695AED1D3C75378C0150F4178177C92EC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery valleyrat_s2 persistence
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  jli.dll
- Size 380.2MB
- SHA256 f1b311418d6ccfe5564ffe2789e446974be55498ee22b133ffc9725ba25adfb2
- MD5 21fb6ff3149ca544548041bc8783fd3d
- SHA1 5065ccedbf5bfd989d9d681d9b507bbbd7ddc06e
- SHA512 91c81d1654e59ad903a6b005a05aacc4a7219a908b207acbbc389366869d1566403f4437bcaf9936972bc065e3a5eb06f7e6bee96be3fac9acb541c315fcc51b
- SSDEEP 49152:5rGPogNVCUqZ4F0p0nK0t64Fcu42xhi+CFGZ/5KiOB/m:5032VCsecdPFG95KBm
- TLSH
  T18B198D35EE950A64D52A8174BA775332D731B830F3E3864B3294D62B3E33B904A7AF15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  msvcp140.dll
- Size 540KB
- SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
- MD5 4e3fa9bd90ef020c14359639dc19312b
- SHA1 a51032ec39a292afda65b0e3053d4ff3e3241512
- SHA512 3e3c62fe860199953cc87e0516b77f6a039f2563cb6b5cc48edc51f243e5ea8fd9b2e3239a089966c403f17a8b3766090bc7b827399cceb00a37bac970855e15
- SSDEEP 12288:M0MrE03u1mHWV/I3z+bQEKZm+jWodEEV7X:M0p1F/IiQEKZm+jWodEENX
- TLSH
  T180C42A23F75906E0E195E3B8A1838702D7F17C5A8322E3C742EB955E2F577D0A63B690
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  ucrtbase.dll
- Size 1.3MB
- SHA256 c2ed69b4a1bb9432c75134e813c70539e27c8c1fe96a784d9be78c874e93d9d5
- MD5 ef62e9b3d7203f825dbf5dda8d4770c9
- SHA1 7f1f99f61082c63a645cea72d41481928b4d19cb
- SHA512 cb79d334af2c436cd62d0f4be8ef8f4f89c4590c666125fd26a218426079beadb9da8cc99cdc28fcef6c3574a4941592f85019aa642f71f1e7559f599b75233c
- SSDEEP 24576:T9KcgsGAmTfFqSgdDWqNUF3Z7Nkqnjqo3JYj8Jszg8mxvSZX0ypapJDBL:T9KpUmTfFqSgdDPq3DjqI08JXpJD9
- TLSH
  T15C55AE6176AD01E9C1BFD13DC64B4606E9B2781503708ADB03E94E792E3BBE9177B321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  vcruntime140.dll
- Size 120KB
- SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
- MD5 0d35c5e99871b4f02c490b9fd9dace34
- SHA1 c2280e6285147cd8010becc0cd3a120fca0088e0
- SHA512 114bc156655e0d3249b6f94af1da80528b6695630f548ab596dfb406f6ffcc65276c9f900b637ba9c244ba5a4331aa15d2de0672f6dcbd38cb49a206c100698b
- SSDEEP 1536:a9pCUgtBAVcxStMXcfG8VwfmpcGLOI5Sv+vecbeQ6N7l9gEeza/yLzt:qyA+3EOfmpcGSdOecbeQ6Nx9Mqsp
- TLSH
  T1B9C37B4272B802FBC16BD274C292AE27FBB6B50687605BDF07AA86650F537D06D3C341
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8 behavioral9
- Target
  vcruntime140_1.dll
- Size 46KB
- SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
- MD5 03b43160d21c08de07a79d0a1c5ee81d
- SHA1 0a449093006af667432b83303614b53b62fc0d05
- SHA512 8b835205bf037b78144f0a4a78618a4e74ba087ac9916c83cb25aff266ddcf5c1b859a6e7c6fec2b57ffeee94fa2f52dd7f6e98c387a4ea7a3143fef6a9570b0
- SSDEEP 768:BezSkbhNfI4fWLZyS/dPWxngU907N9z7RV80X9z+:2YZyuPWxn3Ivz7bDz+
- TLSH
  T1FC237E9293BC4086E89B8970C1DBDE57BD38B7D2576093CB1BA5E54C1E537C0E63832A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral11

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects ValleyRAT payload

Family: ValleyRat

Adds Run key to start application

Enumerates connected drives

Checks computer location settings

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11