valleyrat_s2 | 2026-07-21_6a91ba5b25a8ad334544e78652b5cc3e_amadey_cobalt-strike_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-21_6a91ba5b25a8ad334544e78652b5cc3e_amadey_cobalt-strike_icedid_luca-stealer_njrat
Size 193KB
Sample260721-c4bfjset3w
SHA256 caad2cdcb3a3e8e747d21769e3c666e7a3cbfd4628df318051bebdf4398e1dc0
MD5 6a91ba5b25a8ad334544e78652b5cc3e
SHA1 3190f8099a60a5fc0c83b1f21b0a0b49065a23e2
SHA512 db99a4b61802511519b1a743b7d2c8a92f368f11271a8a6715ef22bf70a64451bb9dccdbbea9607c2beb007fa48a424b3e2285d24b4d58667c0594963e21f7c9
SSDEEP 3072:kg/QAY4A4K35VvcqblytTUvYPYmfOxImFnZfm9H5x9/ET6y5LwRmURAa:k5b4K3hhoQvYPPOmY5m9Gf4F
TLSH
T19E146B49B7E500F9D073823989914657F773B8161760ABDF07A0837AAF23AD4AD3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor valleyrat_s2

Malware Config

Extracted

Family

valleyrat_s2

Version

mwmwmw.e1.luyouxia.net:20173
mwmwmw.e1.luyouxia.net:20022
127.0.0.1:80

Attributes

campaign_date
2026. 7.20

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-21_6a91ba5b25a8ad334544e78652b5cc3e_amadey_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-07-21_6a91ba5b25a8ad334544e78652b5cc3e_amadey_cobalt-strike_icedid_luca-stealer_njrat

.exe 193KB

2026-07-21_6a91ba5b25a8ad334544e78652b5cc3e_amadey_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH 41732eb07837bfb146ccc121dc0d2cfc
SHA256 caad2cdcb3a3e8e747d21769e3c666e7a3cbfd4628df318051bebdf4398e1dc0
MD5 6a91ba5b25a8ad334544e78652b5cc3e
SHA1 3190f8099a60a5fc0c83b1f21b0a0b49065a23e2
SHA512 db99a4b61802511519b1a743b7d2c8a92f368f11271a8a6715ef22bf70a64451bb9dccdbbea9607c2beb007fa48a424b3e2285d24b4d58667c0594963e21f7c9
SSDEEP 3072:kg/QAY4A4K35VvcqblytTUvYPYmfOxImFnZfm9H5x9/ET6y5LwRmURAa:k5b4K3hhoQvYPPOmY5m9Gf4F
TLSH
T19E146B49B7E500F9D073823989914657F773B8161760ABDF07A0837AAF23AD4AD3E721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39260

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

HeapAlloc HeapDestroy DeleteCriticalSection GetProcessHeap HeapCreate EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection WaitForSingleObject Sleep SetEvent CloseHandle CreateEventA GetCurrentThreadId SwitchToThread SetLastError CancelIo lstrlenW CreateEventW ResetEvent WideCharToMultiByte TryEnterCriticalSection SetWaitableTimer CreateWaitableTimerW WriteProcessMemory HeapReAlloc OpenProcess OutputDebugStringW GetSystemDirectoryA GetThreadContext VirtualAllocEx CreateProcessA SetThreadContext GetExitCodeProcess GetCurrentProcess CreateFileW CancelWaitableTimer LoadLibraryW CreateThread GetLocalTime GetProcAddress GetCurrentProcessId FreeLibrary GetConsoleWindow IsDebuggerPresent SetUnhandledExceptionFilter WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetStringTypeW SetStdHandle SetEnvironmentVariableW GetLastError HeapSize InitializeCriticalSectionEx VirtualAlloc VirtualFree ResumeThread HeapFree FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetFileType FlsAlloc

user32

ShowWindow TranslateMessage PeekMessageW DispatchMessageW MsgWaitForMultipleObjects wsprintfW GetInputState PostThreadMessageA

advapi32

RegSetValueExW RegOpenKeyExW RegCreateKeyW RegDeleteValueW RegQueryValueExW RegCloseKey

ws2_32

closesocket gethostbyname select WSAIoctl send socket connect recv htons setsockopt WSAGetLastError WSAEnumNetworkEvents WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSASetLastError WSACreateEvent WSACloseEvent shutdown WSAStartup WSACleanup

winmm

timeGetTime

Name

.text

Size

124KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

940B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-07-21_6a91ba5b25a8ad334544e78652b5cc3e_amadey_cobalt-strike_icedid_luca-stealer_njrat

kernel32

user32

advapi32

ws2_32

winmm

generic