valleyrat_s2 | 6060b686d2bfc038023b23cecbfd9069f8878cdcd0ffc519e9057e657aeaeb9a

General

Target
6060b686d2bfc038023b23cecbfd9069f8878cdcd0ffc519e9057e657aeaeb9a
Size 2.1MB
Sample260731-c8cjeabe84
SHA256 6060b686d2bfc038023b23cecbfd9069f8878cdcd0ffc519e9057e657aeaeb9a
MD5 f7f8c4f4bae051423cffe9c3b2b6eca7
SHA1 8536b82e09c75f01cd3e3c758dfb2ae4ea305ecf
SHA512 3ffd687ad787d6f9f5b336a4fb3ab3d493963c82641a95d477be590718b089a65a7d2adfc2ee3230d4032a2793386acb91fbc7c973deb04d4fccddefb36e9f46
SSDEEP 24576:qiItGPOSsnsjYxBFurEoc6DcLEdXz2Lh:8gPOfs0sEoc6DBXSL
TLSH
T13BA5A224B9BA812DD027FFB83EDDF89EEDAB3A151544646B0141134B8A36AC0CF5B53D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

valleyrat_s2

Version

1.0

C2

154.12.19.70:22011
154.12.19.70:22012

Targets

- Target
  6060b686d2bfc038023b23cecbfd9069f8878cdcd0ffc519e9057e657aeaeb9a
- Size 2.1MB
- SHA256 6060b686d2bfc038023b23cecbfd9069f8878cdcd0ffc519e9057e657aeaeb9a
- MD5 f7f8c4f4bae051423cffe9c3b2b6eca7
- SHA1 8536b82e09c75f01cd3e3c758dfb2ae4ea305ecf
- SHA512 3ffd687ad787d6f9f5b336a4fb3ab3d493963c82641a95d477be590718b089a65a7d2adfc2ee3230d4032a2793386acb91fbc7c973deb04d4fccddefb36e9f46
- SSDEEP 24576:qiItGPOSsnsjYxBFurEoc6DcLEdXz2Lh:8gPOfs0sEoc6DBXSL
- TLSH
  T13BA5A224B9BA812DD027FFB83EDDF89EEDAB3A151544646B0141134B8A36AC0CF5B53D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor credential_access defense_evasion discovery evasion execution valleyrat_s2 persistence privilege_escalation ransomware trojan
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Modifies firewall policy service
  defense_evasion
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Disables use of System Restore points
  defense_evasion
- Drops file in Drivers directory
- Modifies Windows Firewall
  defense_evasion
- Server Software Component: Terminal Services DLL
  persistence
- Boot or Logon Autostart Execution: LSASS Driver
  Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
  persistence credential_access
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
  defense_evasion trojan
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2