Overview

overview

10

Static

static

10

C8972EEE45...ED.exe

windows10-2004-x64

7

C8972EEE45...ED.exe

windows11-ltsc_2024-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    C8972EEE456E4BFF5C0E0E4F6AF024ED.exe
  • Size 130KB
  • Sample260820-dlgqaadq7v
  • SHA256 4e410dec26d0eeb8b1c7c945a2a99bec58150d540328a24581e0a3620eaa5102
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
valleyrat_s2backdoorcommand_and_controlpersistence

Malware Config

Extracted

Family

  • valleyrat_s2

Version

  • 1.0

C2

  • h.vt3rm.eu.cc:443

  • h.vt3rm.eu.cc:22

  • 127.0.0.1:80

Attributes
  • campaign_date

    2026. 8.13

Targets

    • Target
      C8972EEE456E4BFF5C0E0E4F6AF024ED.exe
    • Size 130KB
    • SHA256 4e410dec26d0eeb8b1c7c945a2a99bec58150d540328a24581e0a3620eaa5102
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    command_and_controlpersistence

    • Outbound SSH connection to public host

      SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

      command_and_control

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks