valleyrat_s2 | 2b4ee036ef85bedf523237a821535b698caff060be39967fa314d046fb426684

General

Target
Statement%20of%20Accoun-b.img
Size 1.2MB
Sample260730-g6eyzavya1
SHA256 2b4ee036ef85bedf523237a821535b698caff060be39967fa314d046fb426684
MD5 7e2f9e968faeb8655ff752e337e1d5dd
SHA1 1f35412fbc66c92a3192a3cee0ad82d86e647ce5
SHA512 6d76a338b2d0ceede6004eb3f4253a083315c5c1ea22b9ecd8909b9184da5f57f1fbb08d849e719b326f8d862958ada4eb70c17b5cb2d59bca9971c72a17561b
SSDEEP 3072:XAkO5M963QwRzkP7f1w7BDi2Kwekrr1+zQO0uKFBHUr76ot9MIvsIlc+qr3r4nBW:wk4wT1w7BDiFbkv0dfJ0IPo3r4nByJ
TLSH
T1F7458C4573A40CB9EDB7823CC9538A06D7B2BC1607A0E6DF13A8475A5F2B7D0993E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

valleyrat_s2

Version

1.0

C2

134.122.189.15:433
127.0.0.1:80

Attributes

campaign_date
2026. 7.29

Targets

- Target
  2026 Statement of Account.exe
- Size 25KB
- SHA256 de0b9b6656c9e9fc9db4271610a09c2ae27d07c5a4757e94b2e0314a9dda6ee4
- MD5 e6363b8ec386338ce08f159a739f0e97
- SHA1 331e7b016cc9d497463c8519086cf2b9e07c21ed
- SHA512 aa2998c56f85c70e2bfc02646d67c3cf586b4335226a248845b548be95b4451d6e778d3d79388b411f8a5669ee6af02473c73a808d2b40a4c906c2b9afa81388
- SSDEEP 384:RpK9Wnrf8uylcxFYQt+hQlP0A1r2VHRN7DDtdQ5R9zC4W9rQ:e9WnIuyCr+AO1ds9z+c
- TLSH
  T1F6B27C82A39854C2ED6795B0D2B4E253AC39779A0B50D2EF1250E65C0F623C5BE3C72D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor execution valleyrat_s2 persistence ransomware
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1 behavioral2
- Target
  winhttp.dll
- Size 259KB
- SHA256 f5d17a8d1701114ba468eac763454bd1e4df11a48d21bff7ccc928e89359716b
- MD5 e7666c29cabfa1ff18206326e323a2ca
- SHA1 b8a14585888298f79c1b6bd7b90eaad71d59c617
- SHA512 eb1e71de5f0e3199ae93da127cd4560ed3507eb21923591c7813009e121a1a01f511e73c3ef9efea39ff4565b045e0a61fef667b1af8a1898da48b65b883e663
- SSDEEP 3072:m963QwRzkP7f1w7BDi2Kwekrr1+zQO0uKFBHUr76ot9MIvsIlc+qr3r4nByJ:5wT1w7BDiFbkv0dfJ0IPo3r4nByJ
- TLSH
  T1FA447B5573A40CB9E9B7823DC9538A06D7F2BC1607A0EADF03A0475A9F2B7D0953E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor execution valleyrat_s2 persistence ransomware
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4