valleyrat_s2 | 7968e6224ffe039bb8441de61f59e0cc943cafbc7018b08b797dd84fec024e68

General

Target
03092026_1740_03092026_Statement_202609030012098.img.zip
Size 3.5MB
Sample260903-v8xtfscr4s
SHA256 7968e6224ffe039bb8441de61f59e0cc943cafbc7018b08b797dd84fec024e68
MD5 d530a07ee6102e1ef716e2d0f2944670
SHA1 4f4f78c0d3d5038535194ff14e5bed9e24d1d4a9
SHA512 52cc7780c2f767491cf0f3f5f85369ab5b12395fd9b61cf302fba9fc3c829870e9963b627ca007521336cfca60876fa424ba37c3bf8f07d971a326bdbccf18e6
SSDEEP 49152:jFtGKIaAOnwwqD1wOyL3x18vKesTEIAp8gwSll3V3rp9DEi2HtDdwdTD3ci1/EZg:3IrOnaujLXvYllVrnT2HtypLcgE2
TLSH
T12906330A0F6CB5DC695200704BACDA7E893E2377B44C1ACF354FAE59FA80745629D53D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Statement_202609030012098.EXE
- Size 2.2MB
- SHA256 0fdb63034c7c655e05b3a7725d5e2776606c323ae534bf6f30cd9eeadb3a879d
- MD5 1f884c60594ef47ef9645cd6bae9029f
- SHA1 4a56b30bd2110230bdf44d5b6b1f6642cf14ad1a
- SHA512 13b8456f052e08c30afc4157929e27f1ac11e96d3e1698803b61c019377e32639e92490e4210cec12d454619969f4e91759cc8fd1659cf2c4b4a28aed5db4504
- SSDEEP 24576:8iy/AY+c0d6uNFGAlJZO9WZ32i8OvtgPCpGREue5iAhThPszd96zctco:8iy/L2tFhlHO9WMCpOENiAhTxsb
- TLSH
  T1D2A57C03E2D601EDD03AD5348B465232EA65BC49BB317ADF0A81B2551E7EEF05BBD720
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery dropper execution valleyrat_s2 persistence ransomware spyware trojan
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Download via BitsAdmin
  dropper
- Modifies file permissions
  discovery
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  XwEb_elf.dll
- Size 5.3MB
- SHA256 ae17e4760c0825f5217c0483e10b971993569dcd8e5120043dd290cc73fc672d
- MD5 909cded509a818f14bd9b6835ff5afef
- SHA1 2a28532777f301e4880b628e03dcc66334308beb
- SHA512 ac7b46f5aba38c9bbcf69de297c2d749d6c2c421f6c5574b5145fca92892e463154e53948d76df5b7cb9898ebba3a2e52d47003fe50bcc6f9d28fe2359c6ad36
- SSDEEP 98304:kV2k3db7B/kR8eX5asL1M9PXI+iZ7q1zPPXNAjtVa/uh:kVN/eMi1QI+7NAjtVa/uh
- TLSH
  T170469E016B9D0588D873E2B8C997CA3BD7727C406225C68B01F0BE5BFFB77521E2A255
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence ransomware spyware trojan
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4