Overview

overview

10

Static

static

5

2026081788...BF.exe

windows10-2004-x64

10

2026081788...BF.exe

windows11-ltsc_2024-x64

10

libcef.dll

windows10-2004-x64

1

libcef.dll

windows11-ltsc_2024-x64

1

msvcp140.dll

windows10-2004-x64

1

msvcp140.dll

windows11-ltsc_2024-x64

1

vcruntime140.dll

windows10-2004-x64

1

vcruntime140.dll

windows11-ltsc_2024-x64

1

vcruntime140_1.dll

windows10-2004-x64

1

vcruntime140_1.dll

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    18082026_0318_17082026_20260817185243.D4F8A17C69B2.img
  • Size 3.3MB
  • Sample260818-dtm72afb55
  • SHA256 84a5eefdf00ebbebd720fe6d7d7391a90b18bc821ee65863e6b3783a05fb8840
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
valleyrat_s2backdoordiscoveryexecutionpersistence

Malware Config

Extracted

Family

  • valleyrat_s2

Version

  • 1.0

C2

  • 170.62.130.47:449

  • 170.62.130.47:443

Targets

    • Target
      20260817885699752.930280FCBF.exe
    • Size 718KB
    • SHA256 765d34b234970be7eb12351051eff45d5d9cab515da07e4615381eacdc672d3b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoordiscoveryexecutionvalleyrat_s2persistence

    • Detects ValleyRAT payload

    • Family: ValleyRat

      ValleyRat stage2 is a backdoor written in C++.

      backdoorvalleyrat_s2

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2
    • Target
      libcef.dll
    • Size 1.8MB
    • SHA256 4e4667c6da3a9d00af6a3dc0662f88b99682b66305fffed84b78df4f58eaa72b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      msvcp140.dll
    • Size 572KB
    • SHA256 b5400f8454276f1adf944d8ba393866ca423603254baf88bca7dc4c1cf762116
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      vcruntime140.dll
    • Size 127KB
    • SHA256 98aea63f7c88d733504c08b165fd68a917e256f2cfaeaa742323ef6dddbbce29
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      vcruntime140_1.dll
    • Size 58KB
    • SHA256 1a1ca015a830a357ad5ec882845d732a60368b6c0d8247a009140cd518377f73
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10behavioral9

MITRE ATT&CK Enterprise v16

Tasks