valleyrat | 7a330c11f130d4c459ba733f0fc2a7adafa5093d4a7f41d7b87a92e498d5390f

General

Target
04082026_1532_04082026_tax returns.zip
Size 34KB
Sample260804-xdx7vack4s
SHA256 7a330c11f130d4c459ba733f0fc2a7adafa5093d4a7f41d7b87a92e498d5390f
MD5 0971d7c083a91f3a02fa9dc572e9a05a
SHA1 0cb62f8e5616f322d607ae7d370719e2c9fc1a70
SHA512 27537c1180e98c241967338c545d1026085bb10c15006ba74aa1cce7fc47f1f80d265cef4e1454f28ce2a2e855912bd1d4700b00fe4043a71bf717e430d1ba36
SSDEEP 768:vm7wA6MQd3dmlPtmYhgfb75Z82ohP+w9L2Kf+OJNdQDZFv5T:vg6vOtNuz75Z1cnLJf9XQV95T
TLSH
T1B3F2F186FA4C2A1FCF58E13CD14C0A2567C1115A68B1D2E632786646A1DFC3C1CB47DB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  04082026_1532_04082026_tax returns.zip
- Size 34KB
- SHA256 7a330c11f130d4c459ba733f0fc2a7adafa5093d4a7f41d7b87a92e498d5390f
- MD5 0971d7c083a91f3a02fa9dc572e9a05a
- SHA1 0cb62f8e5616f322d607ae7d370719e2c9fc1a70
- SHA512 27537c1180e98c241967338c545d1026085bb10c15006ba74aa1cce7fc47f1f80d265cef4e1454f28ce2a2e855912bd1d4700b00fe4043a71bf717e430d1ba36
- SSDEEP 768:vm7wA6MQd3dmlPtmYhgfb75Z82ohP+w9L2Kf+OJNdQDZFv5T:vg6vOtNuz75Z1cnLJf9XQV95T
- TLSH
  T1B3F2F186FA4C2A1FCF58E13CD14C0A2567C1115A68B1D2E632786646A1DFC3C1CB47DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor valleyrat valleyrat_s2
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Family: valleyrat
  valleyrat
- https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  taxreturns.dll
- Size 8KB
- SHA256 56e2c9b6b1bee0250613a170e861b5de6ea1bc523985408c557b5b939a607345
- MD5 c1ad913ef1ae815cbfbb8ee33dae9d81
- SHA1 b85a44af8ac2e23595f1ed6e21b2842d499da699
- SHA512 738621cd7616ec4e9ddd54b8cf70ba4889eb7ba8161211429cd161adb527afa0c2355539a3a65053676d14ad5fd7975e0e9b07b0c49805388fb3d56429d46023
- SSDEEP 192:x4nDsb5w9IaWqTXVIghi+1Fl7jP4LsLV0p3:h3Xw6gU+1Fl7DfLV0p3
- TLSH
  T10A02F81A6BD8433ED9EB4E77BCA352500672FB455A13EF5E08C8805B9DB37044B92B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Detects ValleyRAT payload

Family: ValleyRat

Family: valleyrat

https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4