valleyrat_s2 | c5287073ea224385a4a835f1540cbfd5794e0daf844496a99f96905efee7ac6d

General

Target
StatementofAccoun_0812.img
Size 604KB
Sample260828-alaeesek3s
SHA256 c5287073ea224385a4a835f1540cbfd5794e0daf844496a99f96905efee7ac6d
MD5 c49e0773138ad03fd8f2b2006ab4e99d
SHA1 bd3fcbcab213edf101d7ec6d04390a79cc15cbb4
SHA512 a9ce0e71843ac73b27729d4e84004a370dfe266dfc2e1b4a32f30fc50b62d69ce591f25cdb49e6e247f40073e20d6d3e8fa906dce4d17c40180cae376929f7cb
SSDEEP 12288:tP48zmzxYVxiYOenk+7xxqqARFF/DMHG5hTayMkQbP:tP4OeYVUYpk0xMRrLqeVMkQr
TLSH
T156D4015A73A824F9D4B38538CA516616E771B42A133182EF725CC6790F33BE26F3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

valleyrat_s2

Version

1.0

C2

47.75.119.86:5353

Attributes

campaign_date
2026-08-12

Targets

- Target
  StatementofAccoun.exe
- Size 174KB
- SHA256 41d9c8f7662e76d62da7aac907d6419be76f60259241e16e7d8025ed4aa34d12
- MD5 bb97150614bcb7fba7040f6674037605
- SHA1 d3a6234a854886088eb29b21b26125b811a87768
- SHA512 32d77ccc2aec0cda4ef0eadb39a787221d25d7e0f01dcfa2dd23e94b8843037f70bccc6ffa33537acd01c1a04c03a3b0d108a7799abd4d73420d8ff26e8d62c4
- SSDEEP 3072:chlUYCVlFF4smO1RWUdESZhMiPx4DPmCJvo1aJBl0Zbln8D:chOY4tmOymfZJxAPj+sJsA
- TLSH
  T1C4048C5673A824F6D4728178CA959A56F772B42B033183DF035486791F33BEA6E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence ransomware trojan
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1
- Target
  wmicodegen.dll
- Size 377KB
- SHA256 3fb86b9f8d2751a061ad6afb9e9e28362d67473d60214ebf82a3c3806ced0f55
- MD5 87e45663cc6589260948053483e7a72c
- SHA1 cdb714f4fa73a4d761f275f33a33a16ed119923b
- SHA512 9a3d634ce166659f42ef5580664904c5634d9c3b5b5fa423c109c057ac5bf843742954de60e4e976c1d73349a4a975d4005eebdb25dd69e5731e653375d7c952
- SSDEEP 6144:FlkGiJqIWCohnlm+TM4xxiN4BQBGqxXSD2NNlpomMHG5hTayk/k70HGcPL:FiYOenk+7xxqqARFF/DMHG5hTayMkQbj
- TLSH
  T1F48422E972A925FCE5F7C9348B223037C7243524A319D8AFD4D4E9971F2B932BB52502
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence ransomware trojan
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Windows security bypass
  defense_evasion trojan
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2 behavioral3