Overview

overview

10

Static

static

5

LydiaPigou...ay.exe

windows10-2004-x64

10

LydiaPigou...ay.exe

windows11-ltsc_2024-x64

10

LydiaPigou/deploy.dll

windows10-2004-x64

1

LydiaPigou/deploy.dll

windows11-ltsc_2024-x64

1

LydiaPigou...ig.dll

windows10-2004-x64

1

LydiaPigou...ig.dll

windows11-ltsc_2024-x64

1

LydiaPigou...20.dll

windows10-2004-x64

1

LydiaPigou...20.dll

windows11-ltsc_2024-x64

1

LydiaPigou...20.dll

windows10-2004-x64

1

LydiaPigou...20.dll

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    9b52f1201324f2fbd1d7b1821db85dd3ecca21549774a3dc4dea5ce4c1a229ba
  • Size 1.3MB
  • Sample260730-ll3lragk3t
  • SHA256 9b52f1201324f2fbd1d7b1821db85dd3ecca21549774a3dc4dea5ce4c1a229ba
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
valleyrat_s2backdoorpersistenceransomware

Malware Config

Targets

    • Target
      LydiaPigou/SigridMacaulay.exe
    • Size 84KB
    • SHA256 40696754ab51625c15492472d17340fd1be5dd1272f93bc18624352d112b4087
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoorvalleyrat_s2persistenceransomware

    • Detects ValleyRAT payload

    • Family: ValleyRat

      ValleyRat stage2 is a backdoor written in C++.

      backdoorvalleyrat_s2

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2
    • Target
      LydiaPigou/deploy.dll
    • Size 595KB
    • SHA256 9110cb51df35164c4797a84b3c44489d9b4013be5f8de4270094e2330f3dc1e8
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      LydiaPigou/deploy_orig.dll
    • Size 497KB
    • SHA256 1fea7cc9fba0476a52b0d3155d4d3b65a207902447ca944d9fef15934464292d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      LydiaPigou/msvcp120.dll
    • Size 644KB
    • SHA256 e299b35d1e3b87930a4f9a9ef90526534e8796b0def177fb2a849c27f42f1df2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      LydiaPigou/msvcr120.dll
    • Size 941KB
    • SHA256 0d00bf1756a95679715e93dc82b1b31994773d029fbbd4e0e85136ef082b86a9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9

MITRE ATT&CK Enterprise v16

Tasks