Overview

overview

10

Static

static

5

Report.exe

windows10-2004-x64

10

dbgeng.dll

windows10-2004-x64

1

dbgeng.dll

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    0aa4a8ee753610166b9a685b913d58e15ace51d36cbf75eac5ba0d0f941342df.bin
  • Size 4.3MB
  • Sample260831-mt72wasxcz
  • SHA256 0aa4a8ee753610166b9a685b913d58e15ace51d36cbf75eac5ba0d0f941342df
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
valleyrat_s2backdoorpersistence

Malware Config

Extracted

Family

  • valleyrat_s2

Version

  • 1.0

C2

  • 144.172.84.7:6688

  • 127.0.0.1:8888

  • 127.0.0.1:80

Attributes
  • campaign_date

    2026. 8.21

Targets

    • Target
      Report.exe
    • Size 202KB
    • SHA256 db413d7a7f36a922d30489d4df22d8fecd4da3a6e08f0a227ca770d6afa24bc3
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoorvalleyrat_s2persistence

    • Family: ValleyRat

      ValleyRat stage2 is a backdoor written in C++.

      backdoorvalleyrat_s2

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1
    • Target
      dbgeng.dll
    • Size 3.0MB
    • SHA256 05b122a0ae3f203dda3fbe320874ac259db9519ff0194442c3e7c66103ca2312
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral2behavioral3

MITRE ATT&CK Enterprise v16

Tasks