Overview

overview

10

Static

static

3

6d9bc3531e...97.exe

windows10-2004-x64

10

6d9bc3531e...97.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    6d9bc3531e9ff74a43a3cabe031880195df671ed80b202a79bf876219971af97
  • Size 1.6MB
  • Sample260727-kcanyaygkh
  • SHA256 6d9bc3531e9ff74a43a3cabe031880195df671ed80b202a79bf876219971af97
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
valleyrat_s2backdoordiscoveryexecutionpersistence

Malware Config

Extracted

Family

  • valleyrat_s2

Version

  • 1.0

C2

  • 23.249.28.124:53

  • 23.249.28.124:90

  • 23.249.28.124:80

Attributes
  • campaign_date

    2025. 9. 9

Targets

    • Target
      6d9bc3531e9ff74a43a3cabe031880195df671ed80b202a79bf876219971af97
    • Size 1.6MB
    • SHA256 6d9bc3531e9ff74a43a3cabe031880195df671ed80b202a79bf876219971af97
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoordiscoveryexecutionvalleyrat_s2persistence

    • Family: ValleyRat

      ValleyRat stage2 is a backdoor written in C++.

      backdoorvalleyrat_s2

    • Executes dropped EXE

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks