valleyrat | ab62b50e50d8148e7c894df644e62f365dbe2bd7f7ec0039b7d1af42c555562e

General

Target
B57852BA0-4921278-202608~.zip
Size 5.1MB
Sample260820-a75sfszvbz
SHA256 ab62b50e50d8148e7c894df644e62f365dbe2bd7f7ec0039b7d1af42c555562e
MD5 06f293dae6f0f070e9815ca35721d46b
SHA1 b5f28dd7ae4957f8282b104b6657c5804e42e749
SHA512 b2608e957bb67a01e00ca5361b64138c908ece0b5ba5a73c875b6f0ca22e850311866cd82c8bf39c6ec407f384929d6daaece77b5e48d1d9b4bb4858ea3d8f4f
SSDEEP 98304:+mF8xHBycYkWcxHVtpEps+xbg8WacppzOFcfwKJxJoPVwAsTXGzykRdM:XF8W5k1ks+xb81OFtKJWVwANzP7M
TLSH
T1EF3633A282D40EF591B606AB2F160D4D7DCE7619B30DA1AD1F932EEEDC433190CD7A58
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  B57852BA0-4921278-202608~.zip
- Size 5.1MB
- SHA256 ab62b50e50d8148e7c894df644e62f365dbe2bd7f7ec0039b7d1af42c555562e
- MD5 06f293dae6f0f070e9815ca35721d46b
- SHA1 b5f28dd7ae4957f8282b104b6657c5804e42e749
- SHA512 b2608e957bb67a01e00ca5361b64138c908ece0b5ba5a73c875b6f0ca22e850311866cd82c8bf39c6ec407f384929d6daaece77b5e48d1d9b4bb4858ea3d8f4f
- SSDEEP 98304:+mF8xHBycYkWcxHVtpEps+xbg8WacppzOFcfwKJxJoPVwAsTXGzykRdM:XF8W5k1ks+xb81OFtKJWVwANzP7M
- TLSH
  T1EF3633A282D40EF591B606AB2F160D4D7DCE7619B30DA1AD1F932EEEDC433190CD7A58
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution valleyrat
- Family: valleyrat
  valleyrat
- Windows_Trojan_Winos_464b8a2e
- https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  hdp.dLL
- Size 5.8MB
- SHA256 056dd24538084987a5119b4c33b15a43c056a6d1a344b730299971f37e0cc2c6
- MD5 fa21a3fca3eb72a940dbb4237396d522
- SHA1 3602422e9ce411c99b62e1ee704acd7608b9dfe5
- SHA512 33b58f58499092a42b076caf5bc3e9dcd67cb897992fe992e556615249b2df1c55b97d128fbd0517338bb86e2c9b1d01e0feff099a6ca99052dca4b5b913a03c
- SSDEEP 98304:c6CysmjOw4YDZJdbYM6ZahkmUnrSbVHyqbtbZ4OiZrq1DfPHNADtV6v+zM+rwroJ:Bs7wnBP6ZahkmGi1RZ4O7NADtV6v+zZT
- TLSH
  T13856D0913D5C40A6E05B1231CF6BA2BCF2EE7DB03B75315B1680FA1AFB357414A18A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery execution valleyrat
- Family: valleyrat
  valleyrat
- Windows_Trojan_Winos_464b8a2e
- https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral3 behavioral4