valleyrat | b326409c142eb8cb0793506c2c27187bba5f96e3986cda09b2ef3eb47811d3bf

General

Target
20260824.img
Size 3.0MB
Sample260824-crsjascl4v
SHA256 b326409c142eb8cb0793506c2c27187bba5f96e3986cda09b2ef3eb47811d3bf
MD5 a06bdc3dc9a886fc22385d4f45661bab
SHA1 b45aae141d169ae5d78bc3f72d76f9941cf6b1a1
SHA512 6e8e8551a455a0496e447f4ef28627978ba94aeba8979f091430a7b169442d690b4d5befe4cb178452e9851e17b40d21c3ca52bcd4980d2530eca00701da850d
SSDEEP 24576:G1sevYNb8Fpa6aHX7dGP5Kv3Ooc8UHkC2eK9mCy3KxW3ixPEmxsvGrm8Z6r+JQPW:SrxapGInW3Rm2vGaCJQ7
TLSH
T1CBE55B316A624871F85192300151EAAD326E7D20E623DE5B62C6FDDEFBF43C25AD213D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  20260824.img
- Size 3.0MB
- SHA256 b326409c142eb8cb0793506c2c27187bba5f96e3986cda09b2ef3eb47811d3bf
- MD5 a06bdc3dc9a886fc22385d4f45661bab
- SHA1 b45aae141d169ae5d78bc3f72d76f9941cf6b1a1
- SHA512 6e8e8551a455a0496e447f4ef28627978ba94aeba8979f091430a7b169442d690b4d5befe4cb178452e9851e17b40d21c3ca52bcd4980d2530eca00701da850d
- SSDEEP 24576:G1sevYNb8Fpa6aHX7dGP5Kv3Ooc8UHkC2eK9mCy3KxW3ixPEmxsvGrm8Z6r+JQPW:SrxapGInW3Rm2vGaCJQ7
- TLSH
  T1CBE55B316A624871F85192300151EAAD326E7D20E623DE5B62C6FDDEFBF43C25AD213D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery execution valleyrat persistence
- Family: valleyrat
  valleyrat
- https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign
- Drops file in Drivers directory
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  MSOCF.dll
- Size 928KB
- SHA256 041a0aeb76e63f67abb258036b089e27174074c5367d7c7a2a644e3bf9dd3b51
- MD5 dc019e9977416c7e2daa64257c648535
- SHA1 0ec1932a9ea007c80126b2d5801304b79fc4808f
- SHA512 e744a2bbab727e43efb3a1483bf0ec2fbd881223328bb7ffe1bed49ae01baadcdb19fe23e578db52e990b4029b46d60afd0039612bee19c8403546a56de3d212
- SSDEEP 3072:c/YlPe/tTM+9ufk2Nk3Y+nsietwZTtcihJibnqtaKR2jpZ5ydOtydMgtPeLdTxgT:c/xMOWa3
- TLSH
  T140154B71AA624871F845D6351561ED9D322E7E08E523CE5A2182FDCFFBF5AC21AC203D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery valleyrat persistence
- Family: valleyrat
  valleyrat
- https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Drops file in Drivers directory
- Sets service image path in registry
  This determines the executable launched when a service starts. It can be used to establish persistence.
  persistence
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4