valleyrat_s2 | 9a196ca3454b1d79ff706d186342837f26be6400febb0ebe7887c210f311c0f0

General

Target
08092026_1310_07092026_52001707092026EHSJDS.img.zip
Size 6.0MB
Sample260908-qenaps1cmg
SHA256 9a196ca3454b1d79ff706d186342837f26be6400febb0ebe7887c210f311c0f0
MD5 b8a4fdba66076da9ba87eb60b2624d51
SHA1 11bb15efdd676d5a0a4d0977ba4795d15977a837
SHA512 09accc5a2ebe2eeb009286c46317ed4afea87f03169feec0d59bad269d5403bbf3f7dcea49e96ff488f40d8e11f3a26532fbdd2ba00b882a183ddbf35a385a7d
SSDEEP 98304:jUNW6TTmdw+gq+TkXWge6bmcxmJEpCn/fFzgfz4Y/GHYDAO8Q/godREodAnH119G:4g6fmCFkGgTmgC/fFufOULEeo9gq1B5a
TLSH
T1AB56330A0A8E9F557C1188F95B3214253C2D53A6836F1BC7CDC5F1CCF15EECD8869AAA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  52001707092026EHSJDS.EXE
- Size 5.0MB
- SHA256 6fb8f3babb3340088cb1dca374bf3b9c848f4c414c4b28c5fb7e397d9e1c9137
- MD5 b0546b4ec664f26284c400b3819db9e4
- SHA1 cc23f5bb0bb726705f7dc3fa0974543c23b6fe71
- SHA512 e8baed7d53911e3756c90854fdb34bf1dfc602b3902b273feec239ae5b50f9dfd86c2fda969d34f2f96a368df4df15692d5adabbb78307829e654ed43990a672
- SSDEEP 98304:HqjiIn2U7rm0yfujS5zgXMuNE4OiZrq1DfPHNADtV6v+DO:KjiIn2U7rm0ZS58NE4O7NADtV6v+DO
- TLSH
  T14B369EC5AEAC40E8D4AAD03DCB17551BE6F6BC557332479B0160BB5F6F333910EAA221
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence ransomware spyware trojan
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Modifies file permissions
  discovery
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2
- Target
  WebView2loadeR.DLL
- Size 7.2MB
- SHA256 9d1590692a40693a09cd7151d50fa80668002035334dde378082f3689b9ea040
- MD5 3d5555bcb98ce8cf4747b733655101ff
- SHA1 39e80f8b98f58e9ca2ccb82385bebe026e88d465
- SHA512 4e1d87b6b19d0a9d5b9fbae6fda2205b275a8107333884059987c3d89123c2a9d7271097e2892bff22220fa41fcf9824555a8fc62d7431fd5f05eb0bbf5fcfcb
- SSDEEP 98304:qcIFvrbEKwnknMcJAOk8bjdHiaQpNOomXroiQUyXyT9+zxQvTL:4vrAFfEdCzNfmXkYyXyxC
- TLSH
  T15E76AE01A9EC44B9D46EE437C2D7BA6BD2F17C050531860F9F913A466F737029A2B36E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery dropper valleyrat_s2 persistence ransomware defense_evasion execution spyware trojan
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Download via BitsAdmin
  dropper
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Power Settings
  powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
  persistence
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral3 behavioral4