valleyrat_s2 | b969bcbb2c1f2de3640b45e915f04fc25c66dba81bd6c77f420f64b1de533769

General

Target
Open_to_view_7f0c.img
Size 456KB
Sample260819-c2nm4avfpd
SHA256 b969bcbb2c1f2de3640b45e915f04fc25c66dba81bd6c77f420f64b1de533769
MD5 60f94df3b88b8434ea30b33aacd9207c
SHA1 6542463b3d20f9d5abd5daa5a09fb796a9cc135a
SHA512 dc36dcaf90f5079fd580d7d02dc6a1096bacffa45fa5e88f6236ea6316a1939aa71db3a87c869e4f1efaae2351b0245920af993c3e8948bd23d29439ac8c69fd
SSDEEP 6144:7krMvjZgs0tf3QebSCeIEFYMj9mmZTb7Ai4VNHqF63fLmqCvz:4rOjZg9xSFBztZwu83q5vz
TLSH
T13AA4E04ED1800AABEFC1ACF38954D332BC3931DB02E4529AA64FD54C2FD3B5D5958A6C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

valleyrat_s2

Version

1.0

C2

207.56.119.83:6666

Attributes

campaign_date
2026-08-16

Targets

- Target
  Open_to_view.exe
- Size 25KB
- SHA256 de0b9b6656c9e9fc9db4271610a09c2ae27d07c5a4757e94b2e0314a9dda6ee4
- MD5 e6363b8ec386338ce08f159a739f0e97
- SHA1 331e7b016cc9d497463c8519086cf2b9e07c21ed
- SHA512 aa2998c56f85c70e2bfc02646d67c3cf586b4335226a248845b548be95b4451d6e778d3d79388b411f8a5669ee6af02473c73a808d2b40a4c906c2b9afa81388
- SSDEEP 384:RpK9Wnrf8uylcxFYQt+hQlP0A1r2VHRN7DDtdQ5R9zC4W9rQ:e9WnIuyCr+AO1ds9z+c
- TLSH
  T1F6B27C82A39854C2ED6795B0D2B4E253AC39779A0B50D2EF1250E65C0F623C5BE3C72D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence ransomware trojan
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  winhttp.dll
- Size 378KB
- SHA256 d0c5354dc887841f6d8ad4f29c388f2b20e0b377b7fe47a91e7acb80c554b751
- MD5 ebb22e599051b5c88974d1619cbe7316
- SHA1 9515b1c1da5efd046702b04e2a0355660868c892
- SHA512 f8b07035bdd1675bed081eb4e281ec22b81c5dd94f218e25c3b21dc5f29dbc0c8bae5d412ec25d3447e4fe88f98aaaca8a9d735083fde5e159c5894cb36bacc3
- SSDEEP 6144:oMvjZgs0tf3QebSCeIEFYMj9mmZTb7Ai4VNHqF63fLmqCvzL:oOjZg9xSFBztZwu83q5vzL
- TLSH
  T19E84F14EC1800ABBEFC0ACF389449332BD3931DB12E45656C987D55C2FD7B1E5989AAC
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence ransomware trojan
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4