valleyrat_s2 | 61c84e723449c3fc50ef7656bcacf4cad884be579d5ef3ff829d8124f4f44ae0

General

Target
Tax_Notice_32953.rar
Size 401KB
Sample260720-l5en2aes5l
SHA256 61c84e723449c3fc50ef7656bcacf4cad884be579d5ef3ff829d8124f4f44ae0
MD5 7f1348987724cffcdba0eb1eafb05a2f
SHA1 f692829bc2d27be5e207987ecfa24c5fd831f818
SHA512 b1a357c0f6cd8f3091d69a6c5af6e14df30951effc6707429b1042cc1201610786f39d25f1eb2816b8ecf2253881a84b7cb84bf8ce570127a6fbe0d6d13b38aa
SSDEEP 6144:abNew7e4n3DLkK/+thMVR4IGeGaCr8CXeBhxS4N9DlJZcTMzlV9V62:aJl7T3L4hMVyHai3OBhxfN1lJZc4zlc2
TLSH
T1A694231DD913E22F86B5A27D34C35634851EAFA431A7D0DA312E84409EE94E35F17BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

valleyrat_s2

Version

1.0

C2

47.76.121.209:22011
47.76.121.209:22012

Targets

- Target
  Svchost.dll
- Size 1017KB
- SHA256 e2f0384190fb9cb37db3c25c40b16d472e0f8509accbc6be55c12e2c32068583
- MD5 b5a183071ddf5a299ee8c3aee6d0607d
- SHA1 9cd1710b8c73946a26399901f3af1e4304e26b40
- SHA512 52a1820ea9c620c0a2eebd13d5b23b64a70442aae3ad6deb8322e6a67b7ca4f98ea102a8c64733eefbdf871eb980799e761aa075a8c0a43314db2517858c2fcb
- SSDEEP 12288:l4P5kgHioENfaDskPbPwtPkyDXhZNzUzv3IgNaSWYdU4881GNT0Qkb3NnX+S5m8O:l4P5FioENfaDPclXhW/M
- TLSH
  T17E259224B9BA412DD037FFB83EDDF49EEDAB36151509A46B0041034B8A26AD0CF5B67D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

credential_access defense_evasion execution persistence trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Boot or Logon Autostart Execution: LSASS Driver
  Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
  persistence credential_access
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
behavioral1 behavioral2
- Target
  Tax_Notice_32953.exe
- Size 339KB
- SHA256 4fbfbb9c3aeeaf9586bf23d9aac7a5f001f9f655431b971cf15303c7bcba8918
- MD5 07725e29a5c9f17315694307f3d58a8a
- SHA1 13056edfcfe71128231f2872c234eeac839a755e
- SHA512 9010bf6566b50fd1cb5ca485dbba184eba95eac0abd7fd1438d0566eafc5864c2aacd9529721b611e0250f4418024bab06c4b76c9499351f89e7aa2469e53f77
- SSDEEP 6144:QL+B+e2hpHW4j4q0vzVSIMJjT8pMLY3/Hj5S7Zz:0+oeSp2s4jSIijT903fdSd
- TLSH
  T1F2749F15B7A51CF9E967C63DC9424909EF72BC424750EA8F03E00A965F27BA09F3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor credential_access defense_evasion discovery evasion execution valleyrat_s2 persistence privilege_escalation ransomware trojan
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Modifies firewall policy service
  defense_evasion
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Disables use of System Restore points
  defense_evasion
- Drops file in Drivers directory
- Modifies Windows Firewall
  defense_evasion
- Server Software Component: Terminal Services DLL
  persistence
- Boot or Logon Autostart Execution: LSASS Driver
  Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
  persistence credential_access
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  defense_evasion trojan
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4