valleyrat_s2 | 8f51c76c20a5ca3da440056921e12c013bc91b1526386ab3cd2f00f40b18450c

General

Target
Notice from Tax Departmen.img
Size 136KB
Sample260803-qpsceacj41
SHA256 8f51c76c20a5ca3da440056921e12c013bc91b1526386ab3cd2f00f40b18450c
MD5 24de5c864e6898a580f1120faf6dbc7d
SHA1 eb3038e5a4f165061d5c550ae2a021665418acfb
SHA512 5e37e0fe4ab3a3f421b27f9dcc35da7eb209b52ab3de11e3c80ceac3b67866657404f42cbab69396540d19dcad4589f8713ca78927e9cd65b9f128b85d1ef9bd
SSDEEP 1536:4c6KzEsd5qPj6C1vf5HWsvfjvKftzSSKpZRzLzA:4c6Kz9L2j6CdRHWsmdUpLHzA
TLSH
T13ED33A4137A8421BCBFE4A7664E266005B77FA976432D74F3D8C71AA0B6338117217BB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  08.1Statement of Account.exe
- Size 63KB
- SHA256 3d929643ad39e97ddf3a68fa344abc759b4d0671402c6e995194fc3b1480d0f0
- MD5 3444d9086e0d0a9476da9f6003f2439e
- SHA1 e037156359347cf87c3e59830f0d48097067f919
- SHA512 61fe5c33ae8b168fe7808c5f5ba67c4ac77c53ef5b4a98a1f86d919db69007cfe599a695f247018b5f49b51f9239abe1ef2a2cfc1a1a88ac90dd78a6d8d965de
- SSDEEP 1536:Nc6KzEsd5qPj6C1vf5HWsvfjvKftzSSKpZRzQ:Nc6Kz9L2j6CdRHWsmdUpLc
- TLSH
  T174535C4173B8531BCBFF567634D116015BB5EA9B7422D78B2E88B1BA08533C12621BBF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery valleyrat_s2
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  08.1Statement of Account.exe.config
- Size 374B
- SHA256 c0677339fb7f649eea0d90e1c41b187e20b832ce13cc15522eda61cf9d68d29e
- MD5 34434744d339149b0a89199c4b2862b0
- SHA1 215e6c46e0aa4bd87d6f7ca03988752893aeb52a
- SHA512 5aa640d8915412a50c47b860e56166df328bd4d8d663381e78fc9f9eff03a5845cd8fd3b57af8cc74f8e2cdfe7169cd58b9ff877bd572bd98fd25628426df92f
- TLSH
  T117E0D8126DC89D9EDA38165F79606064D57EC3B3018C048CF86E2A7F4F33846A23B256
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  statementofaccount.dll
- Size 9KB
- SHA256 9d3c5d06a2a59e74138f25c88c650c71b7381ad4f8dae971d79e649f8b34595f
- MD5 d4621408aca25f48b86bba8af80a94dc
- SHA1 2ccd7308e27886328c2ea39463b719e863d00fb2
- SHA512 51da42816f3702fea56d6a50509eeebd93ce84e5320a82b13a9fc3a6f7ce293010ee396cefd74d1687ecd08cd65b29e4b087b3ad57c7423b65b1f8a57b8215e9
- SSDEEP 96:CbPobtuw474ivni/YyoXay9IDjjv9+9vYcV/YKObILvedAI6UGjWEcQFoOY7rfG:eoi/7y70I/j9+Ycp4bILve5rG5SOY7D
- TLSH
  T11312EA2677EC07BDCEEA0F3A68A352A00B70E7919523EA1F19C4924BD9B67500F61771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6