valleyrat_s2 | 176f98e28526d338f126e418b6f760223d80a8dcc9bb2747d62855eb1da6c7b6

General

Target
20260831001644-07FF804E8CED.zip
Size 3.4MB
Sample260831-gylfsawcle
SHA256 176f98e28526d338f126e418b6f760223d80a8dcc9bb2747d62855eb1da6c7b6
MD5 665b185a6a2d69d7669428a4208e5508
SHA1 3a8200bb1704d48c9c72fb37ff91bc8fbda52eaa
SHA512 f2e94f149d670960c3a382aa690b7e0925a44cb05529070a61c6fb12cf35e370f10920dc077a7299c455387a54d28c85be13c818b72764265ee11a9fda1ce830
SSDEEP 98304:TXVgVmSZQPo7R2WPCtrEBbdSBCCyb91EeL6Xu5:TVg/Zmo7R2sCtQBbdSBufL6i
TLSH
T1A3F53385F4963CEBF696F9740DA61D3ACA64C41AAC845FCF7289212530B727613F28D3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  _To.CIT-20260831001523.EXE
- Size 2.2MB
- SHA256 5ee63b6078992c5f40854440348de809ca62b94dbe5198fec1db2b541b6c4ac5
- MD5 4a647fe8a5917fae043f1542f69e5d28
- SHA1 b4cfa0c5edf43f19842b76e74a19c4044aa38633
- SHA512 6fc15b57b69a5c82653aa390ad9f7d3699b0931e9d41cd1ac62db8b3a8d812c71da6c4ea49a0c9052f9e904a98d087ff47c19d549ec319aae7205b07a57b998f
- SSDEEP 24576:oX6XfO5N88mRs+Utxlrl19AdTc/wAmdGMYAAkpxop0W:oXK19Rwtxl39ETc4AhFAAGipp
- TLSH
  T1D8B57D17E2E644EFE0A5D8FB86623135B594FC85232AE6CB1750B2B51F76AC01F39B40
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence ransomware
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  xWeb_eLf.DLL
- Size 5.1MB
- SHA256 60c28f50a746bcd38d1db933c6e8667725dd806c1f4ca46cf1f821d05b20fe67
- MD5 b122ff9fe0037f9a96392b352e4aafcd
- SHA1 b46a3b07ef2b05f3548b781dba963ea84a933d11
- SHA512 0248eba130ad8f0c804f621bc2ddeb22d457064a0486d9c33c7ac6237b2562ed1974e9158187abedd3fec05defc629d093972757d43f216e684fb73f21e20149
- SSDEEP 98304:IWePowZJqhmPv7q7EWmI+iZ7q1zPPXNAjtVa/uh:IzIA2HmI+7NAjtVa/uh
- TLSH
  T171468D016BAD0594E862D174C947DA3FD6B2BC407122874B00F1BE5FFFBB7225E2A256
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence ransomware
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
behavioral3 behavioral4