valleyrat_s2 | 3ec56c8d3f27adc202e933a06c6709b4cf99c148a7ab2ae42fbb90483dbc7232

Sharing

General

Target
Statement%20of%20Account.img.img
Size 2.0MB
Sample260805-g1t6pseg36
SHA256 3ec56c8d3f27adc202e933a06c6709b4cf99c148a7ab2ae42fbb90483dbc7232
MD5 e0ef1f84e796741ad9323509b244e1fb
SHA1 a015c9bcadc1b23f919f48fb388329e68750744c
SHA512 5635844ba457c46231cef51f2642d3092c00e721778de20499e0fcdba60c7e9acd614662f1920c09c5cec056fb6b217000f81155826945e43559f51214c91633
SSDEEP 24576:vtv4IRWdu4ar7v8Udy/N+4EG8Z+IGQVX74wPrALhAYvogQEKZm+jWodEE77i:vtv3zTQUQ/NNA+IGurALVvtO
TLSH
T193A58D167B6881D0E1B6E27C819BC609E7B278414721E7CB51A9832E2F27BE54F7F350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

valleyrat_s2

Version

47.76.121.209:449
47.76.121.209:443

Targets

- Target
  2026 Statement of Account.exe
- Size 718KB
- SHA256 765d34b234970be7eb12351051eff45d5d9cab515da07e4615381eacdc672d3b
- MD5 049cee7d33b42c9f21addd23c648927a
- SHA1 5d7c33d4e8bf9f2332d3e299e5c0a95ca36c67b1
- SHA512 f6bc235c22ae1a5133b1d3a80811bd2864cb7abd89f00ab22f70616a4665ab032e37c7f4301f23aa56ea369ee5c66ef7b7382ed1ae07cc0ab0625a2323a82930
- SSDEEP 6144:giTiBkuIgwvp3IRWFr9OgO9nlN9swfsNs0Cc0oGlntzlp0IE:gtv4IRWd9OpLUa+Q530IE
- TLSH
  T166F4DA5A3B78C1D4E1B7E53D467AC989E67228014B21EACF5058432E1F37BE94E7E360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor credential_access defense_evasion discovery evasion execution valleyrat_s2 persistence privilege_escalation trojan upx
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender TamperProtection settings
  evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Modifies firewall policy service
  defense_evasion
- Modifies security service
  defense_evasion
- UAC bypass
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Disables use of System Restore points
  defense_evasion
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
  persistence
- Boot or Logon Autostart Execution: LSASS Driver
  Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
  persistence credential_access
- Windows security modification
  defense_evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies Windows Firewall
  defense_evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2
- Target
  libcef.dll
- Size 485KB
- SHA256 6933940ce023d040e88d9c93707938e5eb32ba86143cf70bcc21ec44b1d66c73
- MD5 f62aff39acd217c8b31d1d7236c10e64
- SHA1 c7b9580e014973b6cb1fb8098acf6e5997b681e1
- SHA512 a07377cec0d2f0839b88101c3dc9379da19a4bdd3855dcd8153247456b31958a11e84483ba488268e81f2ac7a062b7d6b7f208e2d3ef12d258ca1a6b136d80ec
- SSDEEP 12288:adD8jQdcH/+e+4x03av/ihpkSCSb7XOqYb/xSP0IGQpICjsa:E8Udy/N+4EG8Z+IGQVX
- TLSH
  T1CBB4224528EDDD38E4D20C3C98AA5582B8CF70855A5DC5A27E560C2EDBF70EB86DB2D0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

upx credential_access defense_evasion execution persistence trojan
- Modifies Windows Defender Real-time Protection settings
  defense_evasion trojan
- Modifies Windows Defender notification settings
  defense_evasion trojan
- Windows security bypass
  defense_evasion trojan
- Boot or Logon Autostart Execution: LSASS Driver
  Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems.
  persistence credential_access
- Executes dropped EXE
- Windows security modification
  defense_evasion trojan
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  msvcp140.dll
- Size 572KB
- SHA256 b5400f8454276f1adf944d8ba393866ca423603254baf88bca7dc4c1cf762116
- MD5 cdf7a0cc26ed6b4136ce69b74d8694ed
- SHA1 9d7775e53b051a150bd461b0cacebd206bf875dc
- SHA512 deb4397ad18f0267463ac69e629788f5b9c90265ffb69d1f2c360534b6df7c2a0da3c389916430f3a4675ad8ba29c6c6c95dafee07480bfe74fa913934677abd
- SSDEEP 12288:49zqgpPAgLqMpP85TAfvULhNaYv0nJxgQEKZm+jWodEEVht4y:44wPrALhAYvogQEKZm+jWodEE7P
- TLSH
  T1C9C41923B74905E0E195E3B891878706D7F1BC4A8312A3C792EBD69D2F673D1673B290
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  vcruntime140.dll
- Size 127KB
- SHA256 98aea63f7c88d733504c08b165fd68a917e256f2cfaeaa742323ef6dddbbce29
- MD5 d59f36ddcc7460bf5bcd9fde274982bb
- SHA1 062ed05bfabfabe77d63cfa991f8471475aaf776
- SHA512 2dd1da4d55ff8a8e2f8528d3c3afd0af31eea5d049fa9dacebac0f194d9a8c265f10426585b734126a3cafe853e7807279ce39e27d95df314c8c9acbe7d1f079
- SSDEEP 1536:s9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaE/nzR64zESqY:sEnsvReGsWyxLizXFkecbd1aIn34wT
- TLSH
  T1BED39D85B2A402B7D16AC174C2E3AE17FB75B94487A0A3CF03B59A650F53BE09E3C355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  vcruntime140_1.dll
- Size 58KB
- SHA256 1a1ca015a830a357ad5ec882845d732a60368b6c0d8247a009140cd518377f73
- MD5 0bdae05fc660c889f1a3a6fd0d7ca3e4
- SHA1 48572d0da1d1b576f8d9bee7079b2e73edd1f23a
- SHA512 84d3ca24b54fc50c86e497e9853b4e0c49f65f04b09879af250471b4416a025dfd4bf393b32e494329c2d05817a811bd3c69d80e0d3dae86d567ca73c85c096b
- SSDEEP 768:UzzO6ujT3MbR3v0Cz6Sz5q83ywPg1HfV9zxfkbK9zqaQ9zoQ:hq/oMx3hsHfnzxfkizqBzoQ
- TLSH
  T116436CA457784082D99B98B0C1EAEE537D7CB7D60B10924B0BE5E5481F633D1EB3D22E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9