valleyrat_s2 | 2026-08-10_b2747569200bd2ee22a58e1b763c4f5d_cobalt-strike_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-10_b2747569200bd2ee22a58e1b763c4f5d_cobalt-strike_icedid_luca-stealer_njrat
Size 212KB
Sample260810-chm78aygra
SHA256 63a6bcb790369840f43c84185017172d5ad2111f38a57d96a74ea4a11098ebae
MD5 b2747569200bd2ee22a58e1b763c4f5d
SHA1 c01ac9361f461adc044531dc6f916acdf022acea
SHA512 f323266c8455681175e799b12f130def47fc7ee4bb431aec32b1d0dd15ab052f4e2c685447dabaab6aa56a50ef35b251884311c85e455a91d51335f746d52123
SSDEEP 3072:gi1aqZ2wxcKSIvLmTPynOpzeukN5TqkvZZfzN38FG2OmcsPB3gG:owxFSxPyOpz+5eQghgG
TLSH
T1E0247C09B3E508F5E573C1398D629A06E77378555760EBDF03A082B6AF236E06D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor valleyrat_s2

Malware Config

Extracted

Family

valleyrat_s2

Version

127.0.0.1:8888
127.0.0.1:7777
127.0.0.1:80

Attributes

campaign_date
2026. 7.15

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-10_b2747569200bd2ee22a58e1b763c4f5d_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-08-10_b2747569200bd2ee22a58e1b763c4f5d_cobalt-strike_icedid_luca-stealer_njrat

.exe 212KB

2026-08-10_b2747569200bd2ee22a58e1b763c4f5d_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH 207c7029ad1de88092928a67a66b2328
SHA256 63a6bcb790369840f43c84185017172d5ad2111f38a57d96a74ea4a11098ebae
MD5 b2747569200bd2ee22a58e1b763c4f5d
SHA1 c01ac9361f461adc044531dc6f916acdf022acea
SHA512 f323266c8455681175e799b12f130def47fc7ee4bb431aec32b1d0dd15ab052f4e2c685447dabaab6aa56a50ef35b251884311c85e455a91d51335f746d52123
SSDEEP 3072:gi1aqZ2wxcKSIvLmTPynOpzeukN5TqkvZZfzN38FG2OmcsPB3gG:owxFSxPyOpz+5eQghgG
TLSH
T1E0247C09B3E508F5E573C1398D629A06E77378555760EBDF03A082B6AF236E06D3E721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

43764

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

VirtualAlloc InitializeCriticalSectionEx HeapSize GetLastError HeapReAlloc HeapAlloc HeapDestroy DeleteCriticalSection GetProcessHeap HeapCreate EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection WaitForSingleObject Sleep SetEvent CloseHandle GetCurrentProcessId CreateEventA GetTickCount GetCurrentThreadId SwitchToThread SetLastError CancelIo lstrlenW CreateEventW ResetEvent WideCharToMultiByte TryEnterCriticalSection SetWaitableTimer CreateWaitableTimerW GetCurrentProcess GetFileAttributesW VirtualFree CreateToolhelp32Snapshot Process32NextW GetCurrentThread Process32FirstW GetSystemInfo GetThreadContext GetProcAddress GlobalMemoryStatusEx IsDebuggerPresent CheckRemoteDebuggerPresent GetThreadId OpenProcess OutputDebugStringW GetSystemDirectoryA GetExitCodeProcess ExpandEnvironmentStringsW GetModuleFileNameW CreateFileW CancelWaitableTimer LoadLibraryW CreateThread GetLocalTime ExitProcess FreeLibrary CopyFileW GetConsoleWindow SetUnhandledExceptionFilter WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetStringTypeW SetStdHandle SetEnvironmentVariableW GetModuleHandleA HeapFree FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType GetCommandLineW GetCommandLineA WriteFile GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW TerminateProcess ExitThread

user32

ShowWindow GetInputState DispatchMessageW PeekMessageW TranslateMessage wsprintfW PostThreadMessageA MsgWaitForMultipleObjects

advapi32

RegCloseKey

ole32

CoInitializeEx CoCreateInstance CoUninitialize

oleaut32

VariantInit SysFreeString VariantClear SysAllocString

ws2_32

select WSAStartup gethostbyname connect recv htons setsockopt closesocket WSAIoctl WSACleanup WSAGetLastError WSAEnumNetworkEvents WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSASetLastError WSACreateEvent WSACloseEvent shutdown freeaddrinfo getaddrinfo send socket

winmm

timeGetTime

Name

.text

Size

139KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-08-10_b2747569200bd2ee22a58e1b763c4f5d_cobalt-strike_icedid_luca-stealer_njrat

kernel32

user32

advapi32

ole32

oleaut32

ws2_32

winmm

generic