valleyrat_s2 | c7a0914f6e6d1f2e10f2efb476ac62a4abaf45d2f3efa30cc7ce07b3a9e794d6

General

Target
10092026_1444_10092026__HNC.541414281057.img.zip
Size 6.7MB
Sample260910-r4mk5svele
SHA256 c7a0914f6e6d1f2e10f2efb476ac62a4abaf45d2f3efa30cc7ce07b3a9e794d6
MD5 86b906d615d6357a9c21741a29ff0304
SHA1 cf4a2c3a7bc1164299d39a49b57369a2f8b85718
SHA512 b77a8cabebfe0aa661381af523367f8548f5daa19c2d24146d900ff464cb4c8275476876cbb6daad296c08002d11ffb7a8ca965e872fc793c97b29abf6d46da7
SSDEEP 196608:cocl50wWpefv95NIh/XAlonjqzy5eZURAk:cV0pefV8hTnjkRmN
TLSH
T1D266333C6658BF636E69E436E4706553C70C61290E5823CE7D396B8E64FCA4349CE82F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  BE.85258942.EXE
- Size 4.6MB
- SHA256 3f813a74c7107af4e8161a3975d8e4e1368d21850efe154a144d106f3b8e1968
- MD5 913b8ec5e3d327178d93d0ee74aa7386
- SHA1 8371e0f6632f9cfcb4c08dcfa1ab7f7fc851a783
- SHA512 ea2e12e20facc2980c55ba02ea0fe3b60d9bd564a78ffb76ef2d48b597c4b597d78ec093c9d79a807b0f4bd74d3ab4321cfca6280f801f707bd643df81586831
- SSDEEP 98304:UqjiIn2U7rm0yfujS5zgXMuN54OiZrq1DfPHNADtV6v+k:VjiIn2U7rm0ZS58N54O7NADtV6v+k
- TLSH
  T11C36AE45BEAC40D8D4AAD079C9175A1BEBB2BC515332479F0164AB9F6F337910E2F322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence ransomware
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Discovers running processes
  Running process information can be used to identify security tools or plan follow-on actions.
  discovery
behavioral1 behavioral2
- Target
  Webview2loadeR.DLL
- Size 7.6MB
- SHA256 cef390edd972288016e1a16764d52c6e55790737b76d0217ad25c38d3b2742a6
- MD5 dd055810088693f7405cd80ce199e8b3
- SHA1 8cf3d953933c0d285f49c335558f5360cde2d8d2
- SHA512 fdb6a67dfb4698577845b0ce5bf457fb9aa7a3dd26108d65ff6df71aca54271c5cfb1c00981c6d5dfdf8f3822ea1c88e5b0504db0251794c9fd28744b92a7c49
- SSDEEP 196608:2ha0pUaJEG0r26GdgqkT3KWVLQVyRDBwa5GI+7NAjtVa/u:2b4udg3Ta4DB1+7
- TLSH
  T10B86CF427DED00B6D4A5D032CA578DAFD3B2BC542A37965F12913B0EAF337518E1A326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4