valleyrat_s2 | 25a87693ff2e67858bb5379f7f30092b1eba127307b0bcf24029d04911b6ebbe

Sharing

Copy URL Twitter E-mail

General

Target
税務報告書.img
Size 4.2MB
Sample260908-b22paazbmf
SHA256 25a87693ff2e67858bb5379f7f30092b1eba127307b0bcf24029d04911b6ebbe
MD5 69c1ec4a267c2ca8320849ab91b35a39
SHA1 94c272112971c8088065da3ec8dec8dbd0f99f1f
SHA512 e9b5c37389a9f5ddad9b6d0ac1a38f14926c040eeec5475a808610f38af1fb8a2d41bf08b26528a3c5c260b83f48029ac7f6fcc9c30a15609a3f9a4d7cbc1a81
SSDEEP 49152:4uJ71/WLPQuRA7xFstvsULdrALVvtAnLLSl1/Cp44h6KOz/pdTxGGcK3gXtoDL1B:xd7xutnduCp
TLSH
T1F9267D17BB59039ED152623C45878643E271B9888771A7CB33C7816D2FAB3F25A3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

valleyrat_s2

Version

14.128.53.155:449
14.128.53.155:443

Targets

- Target
  FileReportEx.dll
- Size 168KB
- SHA256 b30ffc403371e6f485357d186f5d87b1188a09eeec45be3bb9fe443fbb84057d
- MD5 bd9a658cec13b43a4a55a6ae65c7babc
- SHA1 419472f41fb2115953e32dcf31c607f9aaf015f6
- SHA512 b855c3025aae16a7835952326b4d996761c572c9f949d867edb3571151005e98cf4c771d15123344aa98ad656c0eeba1666ab49cc27c4d31825eaca71133a3c5
- SSDEEP 3072:ZpYVNW2Gc10azqZixqfLH6QpJLXuNjuHW:ALW2KDwqfLH6QruNjuHW
- TLSH
  T189F3194367F5016AF2F76778EDB74502EE31BD820771E24F139055BE0E62F90AA2A312
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion trojan
- UAC bypass
  defense_evasion trojan
- Executes dropped EXE
behavioral1 behavioral2
- Target
  _Bottom.dat
- Size 35KB
- SHA256 c5d9b6e889ac776410b9e70930bc12afa202843d8ec2aa971204c416a3251c76
- MD5 79483a9f07969ab33e5ecbe12b29d769
- SHA1 64a09342152fe750082abac628e6bc94cae0202f
- SHA512 48c1d86e99691877b2ab6ecc4c684151689273c382a8919a443f7c90e9acfb5e53f816a1f53b9ec24794135ce1a7520b9cec9097ca6bf1f6f0a74699e645f08b
- SSDEEP 192:FeOKWCNEMIHSya1GIWobDdYgo/l7w+7w9Q+avOVigD482B1jcpTmKBK/UVJJT1Wc:QglNjAtoW+bvOecpqyXWCEEM90MG0C
- TLSH
  T17EF2B5748790832F5753221D542989CBE2A29728E3F271683FC7684F18BD8F3961DD6E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral3 behavioral4
- Target
  _Driver.cnf
- Size 709KB
- SHA256 29f67c17b528a877949878a3d0453a34c6f5eee7d872edd33c0996b057b56258
- MD5 b8fbc36b39d5bd1bb6d0da70ce07f7f4
- SHA1 325f4441f781645464aaf8560dd4ffa01e7622c8
- SHA512 5e640f04538abc929324d7e50f5aaea522ead4bad87be08c7e82c6adf27140b738a0738b2d05da21bedcce0cf48621c1282719b000f95d5049468258ccf63dfc
- SSDEEP 12288:vLz/pd7aiSCjE6GMguoZEsemrskzmVI4RCsleXXxoIEFQiptnI76SW5//jTOsVBl:zz/pdTxGGcK3gXtoDL1O6BL
- TLSH
  T1B3F4E7877D7F678F980137561683E581A816C9E89EE1CFE8B4CB81F850DC32629C46B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  _Top.dat
- Size 453KB
- SHA256 42f21f4389db441c9b57b765320ba628673bd9856002bb20f0359bfd783d48a9
- MD5 b3f9cede4d9f8a731fd0692628eff2aa
- SHA1 b9836eb17dcbc47fb62b3b7f2cc99b9bd074d6c5
- SHA512 133fd48849e696531fdddb26fa9c9b315eb17cbf1720f45911718e66516f7668b63653795d72d58cdccd7e126de261988bf7a908b19ef46d95d338df0075c3b1
- SSDEEP 6144:VDMSTEXUiscf77mIjrqzMDhYhpp5vcIiAOaSzcchtHC48:uvscf77mIflDW15vcIZOaSx8
- TLSH
  T1DFA43E2C8B50876F8787100E542986EBE222A759D3FA72587FC7280F68EE5F3550ED1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral7 behavioral8
- Target
  liblz4.dll
- Size 121KB
- SHA256 06c6aac092ebc16c6580676a5696186ee1f3d30960c085ff95b2724fec5f8451
- MD5 2f264ae520c8b4c678cbee9cdb13d222
- SHA1 e5a5d6ad0a6ad6ef5b37973668c61c9b21570643
- SHA512 d14d5d636a81f35c0245cc7c080b3a4cecde38168620fb21a0954bb9b691780f43e9257acf68680006abbc9c52be508b1b3cf5d13bed9f53c843f2b7a088af2c
- SSDEEP 3072:RQwOzZKErLfd7xAOGVePvSjZ0370aVEN3AQN0:Rj6ZKErzd7xjGVeXAZ03z2
- TLSH
  T1D2C36B83F6E512BDD162D1BD9AA68217E67579188300EBE787D8CE716F23E900E32315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  msvcp120.dll
- Size 644KB
- SHA256 3b92e964404e3f94531e7d7c4c7419561d9eca6accd98dc3979c9e3596db444c
- MD5 c2028ba6c66363b36ea659ca8816265d
- SHA1 5e2bda10ad417466290dc08fd6ee8bc5fcf0ebbd
- SHA512 28e87d7360c4bd2eb30152173da6fdf30340b5ff0186a68f26514088dcc15758851afd01a179e976a91a9a85f9c1ee0cfa40308ed9d42654739acf6f6dd773f4
- SSDEEP 12288:FOB4p+q4N8d4l2ms4cTHN+m+gy/vEPYysExtvsIvXi1ZG2EKZm+GWodEEpvY/p:iAtvsIvL2EKZm+GWodEEpvYh
- TLSH
  T1ADE45B13FB150AB0E192D37891D78741D7F1BC898822F30752ABE27D5F67391AA2B361
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  msvcp140.dll
- Size 572KB
- SHA256 b5400f8454276f1adf944d8ba393866ca423603254baf88bca7dc4c1cf762116
- MD5 cdf7a0cc26ed6b4136ce69b74d8694ed
- SHA1 9d7775e53b051a150bd461b0cacebd206bf875dc
- SHA512 deb4397ad18f0267463ac69e629788f5b9c90265ffb69d1f2c360534b6df7c2a0da3c389916430f3a4675ad8ba29c6c6c95dafee07480bfe74fa913934677abd
- SSDEEP 12288:49zqgpPAgLqMpP85TAfvULhNaYv0nJxgQEKZm+jWodEEVht4y:44wPrALhAYvogQEKZm+jWodEE7P
- TLSH
  T1C9C41923B74905E0E195E3B891878706D7F1BC4A8312A3C792EBD69D2F673D1673B290
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  msvcr120.dll
- Size 940KB
- SHA256 753ac30c30aae62415cc225e3d057b8b6254afe280696e0a43f1a7c3132632a6
- MD5 b70474fe249402e251a94753b742788c
- SHA1 f53b3c21adf75dc84977067869253e207f1b9795
- SHA512 7776e05fe58cb3c12a4a020def9596ecfb6dc1b1f8ca010ec27a8ae027eadf1eef901acbafe042e2f7b31d1920f62ce163342acf37f96802ec27d68ac7bf972e
- SSDEEP 24576:Nj7dDxvo5outISmDa5HSueghSHkCvx44lmWymt+:NnLLSl1/Cp44h+
- TLSH
  T14625BE4576A106F9D573D2B4CA679647F2B2B85A0530DB6F02E08A6D3F23B30966F313
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  vcruntime140.dll
- Size 127KB
- SHA256 98aea63f7c88d733504c08b165fd68a917e256f2cfaeaa742323ef6dddbbce29
- MD5 d59f36ddcc7460bf5bcd9fde274982bb
- SHA1 062ed05bfabfabe77d63cfa991f8471475aaf776
- SHA512 2dd1da4d55ff8a8e2f8528d3c3afd0af31eea5d049fa9dacebac0f194d9a8c265f10426585b734126a3cafe853e7807279ce39e27d95df314c8c9acbe7d1f079
- SSDEEP 1536:s9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaNxoecbdhUoaE/nzR64zESqY:sEnsvReGsWyxLizXFkecbd1aIn34wT
- TLSH
  T1BED39D85B2A402B7D16AC174C2E3AE17FB75B94487A0A3CF03B59A650F53BE09E3C355
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  vcruntime140_1.dll
- Size 58KB
- SHA256 1a1ca015a830a357ad5ec882845d732a60368b6c0d8247a009140cd518377f73
- MD5 0bdae05fc660c889f1a3a6fd0d7ca3e4
- SHA1 48572d0da1d1b576f8d9bee7079b2e73edd1f23a
- SHA512 84d3ca24b54fc50c86e497e9853b4e0c49f65f04b09879af250471b4416a025dfd4bf393b32e494329c2d05817a811bd3c69d80e0d3dae86d567ca73c85c096b
- SSDEEP 768:UzzO6ujT3MbR3v0Cz6Sz5q83ywPg1HfV9zxfkbK9zqaQ9zoQ:hq/oMx3hsHfnzxfkizqBzoQ
- TLSH
  T116436CA457784082D99B98B0C1EAEE537D7CB7D60B10924B0BE5E5481F633D1EB3D22E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  税務報告書.exe
- Size 439KB
- SHA256 c09d9caef509f0f6001f1d3e3bb7f71d57aa77b7bfa751e198fe12c317cb77f2
- MD5 f5f7037c332180929a8bb0dad231a4db
- SHA1 1b4cf6142b30645385daff016203e32849507d66
- SHA512 a0a5a6f983071aa297b6a6ee818499863b90135b3463ef2056d9c07af1eec2338585accd56e5c2c00de8427a1259c6b0881752c2c06fa2b9daffdf8f3e10101c
- SSDEEP 6144:OzAqL3E52ZoIWPG833BJqYNqN4O6jWMNvkLRrkU6qk+qM8n5dCKqoYXd:/UWG8HBJqYNqCO6jbOLTfDo5dCKy
- TLSH
  T13CA44A5AF62801ECC16B927C9AA79D43F7B1784D47618ACF13D097362F236E16E3E211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery valleyrat_s2 persistence trojan
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- UAC bypass
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22