valleyrat_s2 | 2df08b445585f5db43736868b4bc8428[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
2df08b445585f5db43736868b4bc8428.exe
Size 1.2MB
Sample260914-cpp1dstcpb
SHA256 08f2c963906b126c0a10b47aa28eccebf8e209f3885c54489f771e948dc89b1a
MD5 2df08b445585f5db43736868b4bc8428
SHA1 053f9c64a94448d467f0ca20e0ee5346c2f7a308
SHA512 16aa3cf097282a1c7ba8ec24e4aae23bc2692d97d8b6bfa34c7e612cff353bfb82c62b525a63c75abfac1db5bbb7c1298337a13ca009afd85493ade182a4b067
SSDEEP 12288:/QKreuMBX0bLaL0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:/hQULZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E655123136D0C0B3D147227884F1CBB29EAABCB2076549DB67D02B7B1F745D29B7825A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor valleyrat_s2

Malware Config

Extracted

Family

valleyrat_s2

Version

43.229.114.114:6669

Attributes

campaign_date
2026. 8.24

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2df08b445585f5db43736868b4bc8428.exe

File Explorer

2df08b445585f5db43736868b4bc8428.exe

.exe 1.2MB

2df08b445585f5db43736868b4bc8428.exe

IMPHASH 1fdaeb54e1a420b9565bb2d23869778b
SHA256 08f2c963906b126c0a10b47aa28eccebf8e209f3885c54489f771e948dc89b1a
MD5 2df08b445585f5db43736868b4bc8428
SHA1 053f9c64a94448d467f0ca20e0ee5346c2f7a308
SHA512 16aa3cf097282a1c7ba8ec24e4aae23bc2692d97d8b6bfa34c7e612cff353bfb82c62b525a63c75abfac1db5bbb7c1298337a13ca009afd85493ade182a4b067
SSDEEP 12288:/QKreuMBX0bLaL0DudXezE09Si/ckGHt6pshsPSGkYl2XIQCb+Lk1TWbPXQnAN5L:/hQULZgXe4i7ojhsP5Lgrk1TWb4AN5
TLSH
T1E655123136D0C0B3D147227884F1CBB29EAABCB2076549DB67D02B7B1F745D29B7825A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42203

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InitializeCriticalSectionAndSpinCount HeapDestroy LeaveCriticalSection HeapCreate EnterCriticalSection DeleteCriticalSection WaitForSingleObject SetEvent Sleep CreateEventA GetLastError CloseHandle GetCurrentThreadId SwitchToThread SetLastError WideCharToMultiByte lstrlenW InterlockedExchange ResetEvent CreateEventW CancelIo TryEnterCriticalSection SetWaitableTimer CreateWaitableTimerW GetThreadContext InterlockedCompareExchange OpenProcess GetFileAttributesA GetExitCodeProcess CreateProcessA GetSystemDirectoryA VirtualAllocEx WriteProcessMemory ResumeThread FreeLibrary SetUnhandledExceptionFilter GetCurrentProcess LoadLibraryW GetConsoleWindow CreateFileW GetProcAddress GetLocalTime IsDebuggerPresent GetCurrentProcessId CreateThread WriteConsoleW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID IsValidCodePage GetOEMCP GetACP SetFilePointer HeapFree InterlockedDecrement InterlockedIncrement HeapAlloc VirtualAlloc SetThreadContext VirtualFree ReadFile FlushFileBuffers SetStdHandle GetConsoleMode GetConsoleCP GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter GetStartupInfoW GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetLocaleInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc GetModuleFileNameW GetStdHandle WriteFile HeapReAlloc HeapSize GetProcessHeap GetStringTypeW MultiByteToWideChar EncodePointer DecodePointer InitializeCriticalSection ExitThread GetCommandLineW HeapSetInformation RaiseException RtlUnwind GetCPInfo LCMapStringW TerminateProcess UnhandledExceptionFilter IsProcessorFeaturePresent GetModuleHandleW ExitProcess

user32

DispatchMessageW PostThreadMessageA PeekMessageW TranslateMessage MsgWaitForMultipleObjects ShowWindow GetInputState wsprintfW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteValueW RegQueryValueExW RegCreateKeyW RegSetValueExW

ws2_32

WSAWaitForMultipleEvents WSAIoctl connect WSAStartup select WSAResetEvent setsockopt WSACleanup recv socket gethostbyname send WSASetLastError WSACreateEvent shutdown WSAEventSelect WSAEnumNetworkEvents WSAGetLastError WSACloseEvent htons closesocket

winmm

timeGetTime