Overview

overview

10

Static

static

5

1.exe

windows10-2004-x64

1

1.exe

windows11-ltsc_2024-x64

1

2.exe

windows10-2004-x64

1

2.exe

windows11-ltsc_2024-x64

1

3 (2).exe

windows10-2004-x64

1

3 (2).exe

windows11-ltsc_2024-x64

1

3.exe

windows10-2004-x64

1

3.exe

windows11-ltsc_2024-x64

1

3.pdf

windows10-2004-x64

3

3.pdf

windows11-ltsc_2024-x64

3

4.pdf

windows10-2004-x64

3

4.pdf

windows11-ltsc_2024-x64

3

CCR.exe

windows10-2004-x64

1

CCR.exe

windows11-ltsc_2024-x64

1

HH.pdf

windows10-2004-x64

3

HH.pdf

windows11-ltsc_2024-x64

3

HUI.exe

windows10-2004-x64

1

HUI.exe

windows11-ltsc_2024-x64

1

IJH.exe

windows10-2004-x64

1

IJH.exe

windows11-ltsc_2024-x64

1

LOOS.exe

windows10-2004-x64

1

LOOS.exe

windows11-ltsc_2024-x64

1

LoggerCollector.dll

windows10-2004-x64

3

LoggerCollector.dll

windows11-ltsc_2024-x64

3

MyProg-x64.exe

windows10-2004-x64

1

MyProg-x64.exe

windows11-ltsc_2024-x64

1

TT.exe

windows10-2004-x64

1

TT.exe

windows11-ltsc_2024-x64

1

XIAO.pdf

windows10-2004-x64

3

XIAO.pdf

windows11-ltsc_2024-x64

3

chgport.exe

windows10-2004-x64

10

chgport.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Yonghu66.zip
  • Size 7.4MB
  • Sample260907-psafbsak5y
  • SHA256 4cb99f59f77f7bbaa0cc1e73064df77eaf4646ee4dae7839afe44224daf32ca8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
valleyrat_s2adwarebackdoordiscoveryspyware

Malware Config

Extracted

Family

  • valleyrat_s2

Version

  • 1.0

C2

  • 118.107.43.31:8080

  • 118.107.43.31:8888

Attributes
  • campaign_date

    2026. 9. 4

Targets

    • Target
      1.exe
    • Size 76KB
    • SHA256 b50952f9af310be586746356508b9fd430dcbbaa155a04e6f9563632de0a023b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral1behavioral2
    • Target
      2.exe
    • Size 76KB
    • SHA256 b50952f9af310be586746356508b9fd430dcbbaa155a04e6f9563632de0a023b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4
    • Target
      3 (2).exe
    • Size 76KB
    • SHA256 b50952f9af310be586746356508b9fd430dcbbaa155a04e6f9563632de0a023b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5behavioral6
    • Target
      3.exe
    • Size 76KB
    • SHA256 b50952f9af310be586746356508b9fd430dcbbaa155a04e6f9563632de0a023b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7behavioral8
    • Target
      3.pdf
    • Size 824KB
    • SHA256 a6dde2021305f44bf707b879375811aac356af8d966329cb129df4de2fd0058d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    adwarediscoveryspyware
    behavioral10behavioral9
    • Target
      4.pdf
    • Size 824KB
    • SHA256 a6dde2021305f44bf707b879375811aac356af8d966329cb129df4de2fd0058d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    adwarediscoveryspyware
    behavioral11behavioral12
    • Target
      CCR.exe
    • Size 76KB
    • SHA256 b50952f9af310be586746356508b9fd430dcbbaa155a04e6f9563632de0a023b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral13behavioral14
    • Target
      HH.pdf
    • Size 824KB
    • SHA256 a6dde2021305f44bf707b879375811aac356af8d966329cb129df4de2fd0058d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    adwarediscoveryspyware
    behavioral15behavioral16
    • Target
      HUI.exe
    • Size 76KB
    • SHA256 b50952f9af310be586746356508b9fd430dcbbaa155a04e6f9563632de0a023b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral17behavioral18
    • Target
      IJH.exe
    • Size 76KB
    • SHA256 b50952f9af310be586746356508b9fd430dcbbaa155a04e6f9563632de0a023b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral19behavioral20
    • Target
      LOOS.exe
    • Size 76KB
    • SHA256 b50952f9af310be586746356508b9fd430dcbbaa155a04e6f9563632de0a023b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral21behavioral22
    • Target
      LoggerCollector.dll
    • Size 180KB
    • SHA256 3adb4c15384b451f9f1575e53e8126786ec2eebd4ecbdb60cc6e216974bbab70
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral23behavioral24
    • Target
      MyProg-x64.exe
    • Size 76KB
    • SHA256 b50952f9af310be586746356508b9fd430dcbbaa155a04e6f9563632de0a023b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral25behavioral26
    • Target
      TT.exe
    • Size 76KB
    • SHA256 b50952f9af310be586746356508b9fd430dcbbaa155a04e6f9563632de0a023b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27behavioral28
    • Target
      XIAO.pdf
    • Size 824KB
    • SHA256 a6dde2021305f44bf707b879375811aac356af8d966329cb129df4de2fd0058d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    adwarediscoveryspyware
    behavioral29behavioral30
    • Target
      chgport.exe
    • Size 2.2MB
    • SHA256 255e4c5b81ddabc02455b7b4560e168b4064e63ec3721230201d1a7928c9f158
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoordiscoveryvalleyrat_s2

    • Family: ValleyRat

      ValleyRat stage2 is a backdoor written in C++.

      backdoorvalleyrat_s2

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Suspicious use of SetThreadContext

    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Tasks

static1

Score
5/10

behavioral1

Score
1/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

adwarediscoveryspyware
Score
3/10

behavioral10

adwarediscoveryspyware
Score
3/10

behavioral11

adwarediscoveryspyware
Score
3/10

behavioral12

adwarediscoveryspyware
Score
3/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

adwarediscoveryspyware
Score
3/10

behavioral16

adwarediscoveryspyware
Score
3/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

discovery
Score
3/10

behavioral24

discovery
Score
3/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

adwarediscoveryspyware
Score
3/10

behavioral30

adwarediscoveryspyware
Score
3/10

behavioral31

backdoordiscoveryvalleyrat_s2
Score
10/10

behavioral32

backdoordiscoveryvalleyrat_s2
Score
10/10