valleyrat | 12a22fece1fb6c9aa5620ae910b9b0a98b9013b0b8efb77369ec1bed40ddb18d

General

Target
20260731173614.zip
Size 4.5MB
Sample260803-pderhaxbqb
SHA256 12a22fece1fb6c9aa5620ae910b9b0a98b9013b0b8efb77369ec1bed40ddb18d
MD5 9ebc84914b71b8bb48f51184ff69571d
SHA1 67e81788e2ba823e5cf22726792460ece7b2eed5
SHA512 661d7db0274d9e4dc0f8a00b6eb05206a30f9023ff0aeaee3f0776ee28faf533767a1a071c26f791e8723098bd4eb92d0f133172dfd557a737d5b4fbc40ec95a
SSDEEP 98304:2jnvqae8DezyQn9bNfa3NkiQ66a95AzmPlPHvxjHm8IxFbnVv5hpV9Z4Tg:rae9zyq9Jfa3jByzCxH5HR0FbnVrpV9d
TLSH
T1C32633A3CA2EF05AC816C9CEF4A7806628CBFF78DB47A5534055B597C1CF815C58AC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  20260731173614.zip
- Size 4.5MB
- SHA256 12a22fece1fb6c9aa5620ae910b9b0a98b9013b0b8efb77369ec1bed40ddb18d
- MD5 9ebc84914b71b8bb48f51184ff69571d
- SHA1 67e81788e2ba823e5cf22726792460ece7b2eed5
- SHA512 661d7db0274d9e4dc0f8a00b6eb05206a30f9023ff0aeaee3f0776ee28faf533767a1a071c26f791e8723098bd4eb92d0f133172dfd557a737d5b4fbc40ec95a
- SSDEEP 98304:2jnvqae8DezyQn9bNfa3NkiQ66a95AzmPlPHvxjHm8IxFbnVv5hpV9Z4Tg:rae9zyq9Jfa3jByzCxH5HR0FbnVrpV9d
- TLSH
  T1C32633A3CA2EF05AC816C9CEF4A7806628CBFF78DB47A5534055B597C1CF815C58AC2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution valleyrat
- Family: valleyrat
  valleyrat
- Windows_Trojan_Winos_464b8a2e
- https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1
- Target
  PdFcOrE8.DlL
- Size 5.4MB
- SHA256 ecc1cec9c0c0376b7d5d019810d378dc3e1ea4296031c9ce8b0be40ab26bbd3d
- MD5 395e1873839dd3be5d02e4d1d574f9d0
- SHA1 eba80dd84508c7b4bba2ba5ddefa4cd2b61b8a6c
- SHA512 0548753869e78889232b7c6c4ba21c134f28f68dce2c0ce4ceecbad1696b82cf660fc2e3c28fb7bed315684a08ee03f436373ab42571414596b9a240a06fed25
- SSDEEP 98304:HixqMFUQc4kiNCaq8YR0GPwxI6p69YMluZF5uHLKWtBBIaX1CJWaGJfYt:HihkAd0uZF5urKWrBIalCY
- TLSH
  T12046CF213A804839E1D70174C91FB264E2FF67B01FB9008BEAE89E6C2975D426776D77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2