valleyrat_s2 | 046a8387a8c897fafba0fcb3b736f2d8a0e02c73b518d7c72db6c4eec59fc87b

General

Target
StatementofAccoun_a468.img
Size 806KB
Sample260823-frq71sshlf
SHA256 046a8387a8c897fafba0fcb3b736f2d8a0e02c73b518d7c72db6c4eec59fc87b
MD5 5900dc2a88aea62b7e58d0113203a5a5
SHA1 28f8e2562c854046f8f8f6201025ef05e8b2d751
SHA512 6d1d5f1d35f64d12b3ffd924911701908055db5c5af6f2b6657ad5beaf2551cf0ae5ce9789e8c2c09fff1fdebb6e85610d13ef2822b9d9b4ab911c4663ff7dbf
SSDEEP 12288:ck5G8N847bS8v5rMOMT/rl2SZls33OHn0Mn1vE7TfoT:x847bS8lMVHnZlsEE7Tf4
TLSH
T170056A46F6540CA7F1D68F3989724B06EE6A78FE0365DACB32BC42563F172905F2B211
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

valleyrat_s2

Version

1.0

C2

47.75.119.86:5353

Attributes

campaign_date
2026-08-04

Targets

- Target
  StatementofAccoun.exe
- Size 382KB
- SHA256 ffeaef9bc1ce54c3fac9b9517804ca1b73b905c6c0b10ab6fd1dd5615c15bc47
- MD5 32b03da03c2fec73d028114276a897da
- SHA1 2473216fee29bcc660694c32f0a6378295b1e896
- SHA512 5539b28f8d0679b992d744c70872d933fc11caa069b6d8388734487de43bf5464505e2c11f2281c53394c76ed1fdb4e09c4462a4e6e25d534c1ecc3a43853c00
- SSDEEP 6144:IfGoU5G8+K848hEBbS81wfDM5rMOMT+pcBrk:ek5G8N847bS8v5rMOMT/rk
- TLSH
  T1DB847C5AF7A404F5D0AB8239C9638506E7727C9A0770DB8F23A4476B2F272E05D3E761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence ransomware trojan
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  VSPMsg.dll
- Size 371KB
- SHA256 7233fabbcdc39286fbc600fb29281ce86c350bcbba81a54764e54d26e28b3d87
- MD5 0985ef5e034304738bbcb95f87cd7bd5
- SHA1 c255b5d7f0250293ab901fa07e8e7728e3a734a9
- SHA512 c85f8a8fb38b531d7968de1f5f54f2bdfe7ff1a20564c380d176b103fc83f0e2c6bad6e8ee6a69bff5e67ab3dea73d9c9a134f6786a2ecc792e0e8399473a7a1
- SSDEEP 6144:mnKLlYlj9Y4smsLDZYK/OHn0Mf/QqpqqGx7R30ifoTY:m2SZls33OHn0Mn1vE7TfoTY
- TLSH
  T1ED84CF4A75400CABFAD38F3984B35F42DE1D3AFC431AD6EA707C5092BE966606FA7111
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence ransomware trojan
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4