valleyrat | ee0ef34a4402dea54ec8b4e0557de9605a038a4f2b82380f2978296fd60f9791

General

Target
J-A20260727022544.zip
Size 4.4MB
Sample260727-k1dqhack5x
SHA256 ee0ef34a4402dea54ec8b4e0557de9605a038a4f2b82380f2978296fd60f9791
MD5 7c5fe652c8059fa01219d3d24585617a
SHA1 54d1e6d3ced1cc9fffd64dd7ffa36c4c96bfe27e
SHA512 39d9497e2c26fd6145d50d359a5999697525c3566b06df1c1ac200c4f701b0c339c296127405cd581d10dcb66f409f78d4b7f66db934e5edd4485a44faa74d0f
SSDEEP 98304:ccl6iskaJ7RSCMdWj671UtcJwvFqqL/fTwg5KQv+xuJrYjmwo/qc1STeKAC4okL:lqh7IY6ZUysz/7wOKi+8omwGSeDCm
TLSH
T1472633A20442AB8B5B633FA5B1033D6B284BD1F06478FB85E3DBD8C3F69D156116B52C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  J-A20260727022544.zip
- Size 4.4MB
- SHA256 ee0ef34a4402dea54ec8b4e0557de9605a038a4f2b82380f2978296fd60f9791
- MD5 7c5fe652c8059fa01219d3d24585617a
- SHA1 54d1e6d3ced1cc9fffd64dd7ffa36c4c96bfe27e
- SHA512 39d9497e2c26fd6145d50d359a5999697525c3566b06df1c1ac200c4f701b0c339c296127405cd581d10dcb66f409f78d4b7f66db934e5edd4485a44faa74d0f
- SSDEEP 98304:ccl6iskaJ7RSCMdWj671UtcJwvFqqL/fTwg5KQv+xuJrYjmwo/qc1STeKAC4okL:lqh7IY6ZUysz/7wOKi+8omwGSeDCm
- TLSH
  T1472633A20442AB8B5B633FA5B1033D6B284BD1F06478FB85E3DBD8C3F69D156116B52C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution valleyrat
- Family: valleyrat
  valleyrat
- Windows_Trojan_Winos_464b8a2e
- https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  PdFcOrE8.DlL
- Size 5.5MB
- SHA256 d265fcf18b14b98e55aa9fffd6b64b39de84304a1796854e72eef35bc6dca2c6
- MD5 7e41ded03b900c61467b70ca1718fed2
- SHA1 ceb851e0aeb27295b8221a3f5e225c9db0790051
- SHA512 63ca550b570606a2337d24a57baf9069b8cf73c9ef54f353bd177eee04539a3bbd744dd915263739a4077272714e5fdbd8e122724051fa630729b556329b0371
- SSDEEP 98304:0nJkIC4LTSPakN6RaSnZ0qTTJ8OjWrh6Wfa/oSoL4/aC+gsMjLqWaG0T:iJHT4P39fa/oSuFm
- TLSH
  T12446CF913A40646DE2D7013C4E1DB365D3EE4BA01F3A90CBE2D4E96E29315C2E727E67
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3 behavioral4
- Target
  Vat.No.20260727022528.EXE
- Size 3.5MB
- SHA256 3a0583f7d3f41e1c2c36fa585ad620a518ab6661767f2e9683023745b6f58c4c
- MD5 cae7e1192eb824214833bb1e8ac092b8
- SHA1 dd2bf5cb2a7c29e4a8b7fb405ec2a9e3e9376e81
- SHA512 9fc3a12887dc3c3b82140b3ef591aad68b3407bfec3e7a292dec2417052069c14976e8fcaeea934dc81d58aca85a583979141c4463aa5924fb7c933d648b122d
- SSDEEP 98304:Yi3bpjg3E9+w1Wf/46VK2CvW+gv0AdIsf/M2Xc5ISM5:DV0w2C7qIsfU2Xc5ISM
- TLSH
  T198F58D20BAC08036D97216324DAA7739A6BDFE301B35A1D752543E7839307D26D396BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution valleyrat
- Family: valleyrat
  valleyrat
- Windows_Trojan_Winos_464b8a2e
- https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates processes with tasklist
  discovery
behavioral5 behavioral6