valleyrat | 194845853f864088bc9fae5c0b2f692f6d6b1564f41111041247b3f86d356f30

General

Target
-A2026804002105.zip
Size 4.0MB
Sample260804-w3tehsxdkf
SHA256 194845853f864088bc9fae5c0b2f692f6d6b1564f41111041247b3f86d356f30
MD5 2eba26f01155a443a3924b45dba0639b
SHA1 1ac8d260ecc57999531dab27cf1c07fd92eb168c
SHA512 13e28844416dfb629f10879e9d0ceb6d8e57487ffdd09df1194ee70776d4c7ce3017a20969a4af868e31f5f1735c26b9a5154301f139807ab69edfe48977148d
SSDEEP 98304:6xP4M/QQ38TSOsK+/UfyoFfeLOALt9+Q3k2uuy8ct2BsNpQ2j++:6z/18TWK+sfy6MjLrH02uuy8ct2BP2jp
TLSH
T14E163353C0387EB2C2CCB37162E2D9C96099D551C0B2E8B3F277958F9CD69522E6B44B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  -A2026804002105.zip
- Size 4.0MB
- SHA256 194845853f864088bc9fae5c0b2f692f6d6b1564f41111041247b3f86d356f30
- MD5 2eba26f01155a443a3924b45dba0639b
- SHA1 1ac8d260ecc57999531dab27cf1c07fd92eb168c
- SHA512 13e28844416dfb629f10879e9d0ceb6d8e57487ffdd09df1194ee70776d4c7ce3017a20969a4af868e31f5f1735c26b9a5154301f139807ab69edfe48977148d
- SSDEEP 98304:6xP4M/QQ38TSOsK+/UfyoFfeLOALt9+Q3k2uuy8ct2BsNpQ2j++:6z/18TWK+sfy6MjLrH02uuy8ct2BP2jp
- TLSH
  T14E163353C0387EB2C2CCB37162E2D9C96099D551C0B2E8B3F277958F9CD69522E6B44B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution valleyrat
- Family: valleyrat
  valleyrat
- Windows_Trojan_Winos_464b8a2e
- https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  PdfcOrE8.dLL
- Size 3.8MB
- SHA256 f856bcab6dc2d2c4a047202d301f23b6b9e9ffe5ef5c85b5431bff69442ae95f
- MD5 7125e2d1c3f52a4217adbe4140a1c36f
- SHA1 08a9b79fd07a624aa9d74eb76059d2a89ba08bf1
- SHA512 3f2537b9486cfbbe376c7d8d28315efb804713f061dc5f624b8705eb41a8be8d50ec082aca325f56c789477144da7bf0bb792bd3cce9598f9df04e81be54fafb
- SSDEEP 98304:UxXIrHdD52XJXi6zfBboqhpkLxLArdxOrxSLgkfjsSzPyiAbA:UxW9D5+XroqhpYxLArDMxLkfIsEs
- TLSH
  T15006D0013541C07BD5EF1E305A39BAB9F2BDFA7006F500CF36D4A799297289385267AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
behavioral3 behavioral4