valleyrat | b856a8d469bae6f192b89f05c09a91b89682688a99a6c2bb8381d7d7cd28aab6

General

Target
20260730141517.zip
Size 3.7MB
Sample260730-nbpm9ahj8w
SHA256 b856a8d469bae6f192b89f05c09a91b89682688a99a6c2bb8381d7d7cd28aab6
MD5 09aa7c08229af39974d80d9f704bff17
SHA1 7a60eb1efa7e3ed089d248d675a18718e935d588
SHA512 97649aa6c03a30f4e08f3bf9a9d94ab655d55189f07be24a091c5417b977918cbf0afa480930c0cde7c8af2cd34234f69f260752c4f215b8b21c1006ee84f036
SSDEEP 98304:aDud2onG3vIvOROR+KEe3Wk1TaZEMV1gUJKc:aDu8AG/YTmen1TaBLKc
TLSH
T14806339F83C7589CC29D7427F4ADE2435AAB3E5E62168AE03C1470DD151058A2FBFC9B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  20260730141517.zip
- Size 3.7MB
- SHA256 b856a8d469bae6f192b89f05c09a91b89682688a99a6c2bb8381d7d7cd28aab6
- MD5 09aa7c08229af39974d80d9f704bff17
- SHA1 7a60eb1efa7e3ed089d248d675a18718e935d588
- SHA512 97649aa6c03a30f4e08f3bf9a9d94ab655d55189f07be24a091c5417b977918cbf0afa480930c0cde7c8af2cd34234f69f260752c4f215b8b21c1006ee84f036
- SSDEEP 98304:aDud2onG3vIvOROR+KEe3Wk1TaZEMV1gUJKc:aDu8AG/YTmen1TaBLKc
- TLSH
  T14806339F83C7589CC29D7427F4ADE2435AAB3E5E62168AE03C1470DD151058A2FBFC9B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution valleyrat
- Family: valleyrat
  valleyrat
- Windows_Trojan_Winos_464b8a2e
- https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Enumerates processes with tasklist
  discovery
behavioral1 behavioral2
- Target
  PdFcOrE8.DlL
- Size 3.6MB
- SHA256 a81b2427fe5a5755207fd8a60d0e067cb212dac40f5f97f8854e614cf42d7e22
- MD5 39f2f3d2b5314d627984e73de641d42c
- SHA1 4ab958f432f9374d7e5aedec9609e27f236888c0
- SHA512 199e100909cb20facce96ad71e420b8d61109a014de53dadb3c84dd08023f64042c1e371d8c35d8fc615cf3bcadd39726dc89725f8f9fbe3a2c5dd357a9831e1
- SSDEEP 98304:k5m+BLbQJalQJj/ZfooKzVWU4Dsc7LrHVRjD4C/EkL1fqAOkL:VWgAM/ZfnDsc7nHXP/Jf8kL
- TLSH
  T15E06CF137DD146AFC56B03318A1AF2BD32BCA5640725C4D7A388DF1C3D386A266EB617
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral3 behavioral4