valleyrat_s2 | a7b601f4d4438f890c002d2a003d0e2e7f14a2a47f3cda171b294830ff3f5f5f

General

Target
2026-09-09_f58c85932b71ec76b3dcea10c4a6520f_cobalt-strike_ghostweaver_icedid_lockbit_vidar
Size 376KB
Sample260910-1cj6dayvht
SHA256 a7b601f4d4438f890c002d2a003d0e2e7f14a2a47f3cda171b294830ff3f5f5f
MD5 f58c85932b71ec76b3dcea10c4a6520f
SHA1 2f48a5be5dcae96b337991e6329bf054e11d3f2d
SHA512 0a4b258f9203ce1c813a57e43e82d8b66169674dabfe6604feae86f6f50f83689cc79b23e216036fcb95507a0d8613a1a84f2d49a54dd554b79150d509009ce1
SSDEEP 6144:AHdhPDjUVFPeDADETZZX+t4Z0dS7jNt5z1GExQol0XAD35m0ampO83rvdcp:AzDQL2iqjNeKQG5+YV
TLSH
T1B1848C1772E850F6D9668239C9A38A06FB73781607209B8F17A4477A1F237D1BD3E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

valleyrat_s2

Version

1.0

C2

192.252.183.148:8888
192.252.183.148:6666
192.252.183.148:80

Attributes

campaign_date
2026. 9. 3

Targets

- Target
  2026-09-09_f58c85932b71ec76b3dcea10c4a6520f_cobalt-strike_ghostweaver_icedid_lockbit_vidar
- Size 376KB
- SHA256 a7b601f4d4438f890c002d2a003d0e2e7f14a2a47f3cda171b294830ff3f5f5f
- MD5 f58c85932b71ec76b3dcea10c4a6520f
- SHA1 2f48a5be5dcae96b337991e6329bf054e11d3f2d
- SHA512 0a4b258f9203ce1c813a57e43e82d8b66169674dabfe6604feae86f6f50f83689cc79b23e216036fcb95507a0d8613a1a84f2d49a54dd554b79150d509009ce1
- SSDEEP 6144:AHdhPDjUVFPeDADETZZX+t4Z0dS7jNt5z1GExQol0XAD35m0ampO83rvdcp:AzDQL2iqjNeKQG5+YV
- TLSH
  T1B1848C1772E850F6D9668239C9A38A06FB73781607209B8F17A4477A1F237D1BD3E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor valleyrat_s2 persistence ransomware
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects ValleyRAT payload

Family: ValleyRat

Enumerates connected drives

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2