valleyrat | 93df03d7db7df23317ee87ebe3946ddff4364e45de5217b0c90c7925b22c8f04

General

Target
RKM-20260709-1514.zip
Size 136KB
Sample260804-dslb2s1cqh
SHA256 93df03d7db7df23317ee87ebe3946ddff4364e45de5217b0c90c7925b22c8f04
MD5 f83cb55dde22e692fba8fac00729499e
SHA1 650ced7453b91f38ba0d7a8517b6cd6582a2bf44
SHA512 36febc61f02eafc8f627d9f7cb6ffa32612ebeb6d9a739cf6ebf07dda276510da9d0be7f6bf3de17c98ec83cbedb45086137e6131eec11178101facbd03df599
SSDEEP 3072:r1t8PzsmTrqFSssSGZ3Gme/TRVGPC81ljlurlE:P87jK4QGsmebRgPCUjQrW
TLSH
T167D312D7D982B1B4B8A4D3B74434FEECF48198F146C0333CE1D366B654F5319AA1AA89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  RKM-20260709-1514.zip
- Size 136KB
- SHA256 93df03d7db7df23317ee87ebe3946ddff4364e45de5217b0c90c7925b22c8f04
- MD5 f83cb55dde22e692fba8fac00729499e
- SHA1 650ced7453b91f38ba0d7a8517b6cd6582a2bf44
- SHA512 36febc61f02eafc8f627d9f7cb6ffa32612ebeb6d9a739cf6ebf07dda276510da9d0be7f6bf3de17c98ec83cbedb45086137e6131eec11178101facbd03df599
- SSDEEP 3072:r1t8PzsmTrqFSssSGZ3Gme/TRVGPC81ljlurlE:P87jK4QGsmebRgPCUjQrW
- TLSH
  T167D312D7D982B1B4B8A4D3B74434FEECF48198F146C0333CE1D366B654F5319AA1AA89
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery valleyrat persistence ransomware spyware stealer
- Family: valleyrat
  valleyrat
- Windows_Trojan_Winos_464b8a2e
- https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  nvml.dll
- Size 9KB
- SHA256 e4eec8cfe799202981413b06fba0f580c45598cacde6546a3011004cac051c9c
- MD5 c1c52a589d1df21ce689064f4909bbf7
- SHA1 b938e5486ff34d9b1fc6aabd52f9c55ae724960a
- SHA512 c7eb1eb5c2d31e0c9f88e9220e6de3f300bd42b8789f7b4a9079ef5a6ef1daebe6fefdb2047281ce7ad3c5d0eac6010b8b6eefe22b7d24bdae0799abb852753b
- SSDEEP 96:CImuesLD1YDcOLY7dikO6w1ZPCls1ZKOZghKH1yhx8Qa1LoBUS75GRlg0N57bdD/:ChuesLpq3Y7rkkmxLrroBUSFaFbdDl9
- TLSH
  T13B12D835F79724EAE467EF3466E6953678B6783816282E7D10D0DB3F3915CC4282CD02
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4