valleyrat_s2 | 714e447167865ffd6039c18e3d7c94c443c3c5939bbc4f096b68ae660c1ecba9

Sharing

Copy URL Twitter E-mail

General

Target
16092026_0949_15092026_Reconcile an account.img.zip
Size 1.5MB
Sample260916-ltdmlaycnf
SHA256 714e447167865ffd6039c18e3d7c94c443c3c5939bbc4f096b68ae660c1ecba9
MD5 53c2bf90b40cf348f20130bce79bc36f
SHA1 b6127d72c1c8e586b7aeefea476cffc773646fdd
SHA512 8f3f2a674e3bcfaa930f39195fca1021027bc372ab5ca41193a20767e22d80781d51e0700135dca5de5853ffbf80ce0439490764071bcb462419be779ac85423
SSDEEP 24576:qS/XuhoO3/opFWNSkx8a6DONK9mvtmMNlQRtEXI9CavMEdnvN7/aJHs3PN0sYeOk:qZ5vonuJxWmvsMAKXI9CafvZax8iq
TLSH
T1977533C7A6C66F281B1799C4185FA06263DDD4E804316C83973F56EBB58B3EB483236D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

valleyrat_s2

Version

156.251.18.127:449
156.251.18.127:443

Targets

- Target
  20260915.80521125.EDF026321CDA.exe
- Size 35KB
- SHA256 b92632bdc48ba876cb7bbbda4348eac771fc5a450f4b4f3afa09b2efcedd79f6
- MD5 162262bed55ed7282dad1277936716d5
- SHA1 b50d2e594e6a9999970d4bb47e40fdd92d344e3d
- SHA512 8df774adc17ec97055570e7a7b188a8ebfb89eb58e657beb2df043f5cdeb14592f2c4b88c2b87c6d16a09568567290e9b3c121bdc974b0a6f446983b1ca3a792
- SSDEEP 384:a1LkkX41705BjYjLq91cpUokGkrmf0aGa4rsHDgvKvCy8RbmL4nNy7hFjO:wfS44UokhrO0aGa/8v/5ALTFq
- TLSH
  T116F2A5F24618090AE89BBA7DB497F93D54347D21AE83D2AD71E8DC333D3A78269C7105
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery valleyrat_s2 persistence trojan
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- UAC bypass
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  calibre-launcher.dll
- Size 156KB
- SHA256 7de1a0910a7aec98e5c3fc81432d692aff2086c94c71d5d44720c076d6dc6d65
- MD5 9603fd9e9f55de4ca86d366329cbe880
- SHA1 075216daf9afd7045bdc36fd9b19f89f1ecd15af
- SHA512 7da9b6510f469964a0fd87134fe78bf4f870fc0b2743b16e8955021ec521762c83a66380e50ef6fea14874e3fb0fb0e5dd6cdfce771dd52f17756cba2e7c14f2
- SSDEEP 3072:neDws0VkGR9I/MuA5OFVqfLHgmnk2CZev9+s/x:neDJ0VkY9Sw2qfLHK2CZo9+s/x
- TLSH
  T1B1F3F84723F80465F2F76779ADB61502EE72BD860731D34F0290A26E0F66F90BD66722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion trojan
- UAC bypass
  defense_evasion trojan
- Executes dropped EXE
behavioral3 behavioral4
- Target
  msvcp120.dll
- Size 644KB
- SHA256 2abf0aab5a3c5ae9424b64e9d19d9d6d4aebc67814d7e92e4927b9798fef2848
- MD5 46060c35f697281bc5e7337aee3722b1
- SHA1 d0164c041707f297a73abb9ea854111953e99cf1
- SHA512 2cf2ed4d45c79a6e6cebfa3d332710a97f5cf0251dc194eec8c54ea0cb85762fd19822610021ccd6a6904e80afae1590a83af1fa45152f28ca56d862a3473f0a
- SSDEEP 12288:N2fus43uu43Ry4GHlT4xH2K+M+/i+WSpY+7YOzCaK9A3gS2EKZm+GWodEEwnyh:muJzCaK9AB2EKZm+GWodEEwnyh
- TLSH
  T11EE44C13FB150AB0E192D3B891D74741D7F1BC898822E70752ABE27D5F67391AA2F360
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  msvcp140.dll
- Size 620KB
- SHA256 76c9060fd749d837c92b716a91a190b038f2c03e46da124a36f88075361a9be5
- MD5 ab15feb56d735f4589217d02464b1a06
- SHA1 1362b65006aad34031e51ab005ea54b7337c734a
- SHA512 031a85e5f6973d473641cb84668a3923682b9ab92958a23b3a68f2fb2ccfc79ae0982c7cdef1a28bdfad486c0b411c9eee40188cec6724099e68fa3a2a2543bd
- SSDEEP 12288:CKud5zgdkWhgdq/fazwEQ96d2GYGyQEKZm+jWodEEVmHT:0KqzwEQ9+2D9QEKZm+jWodEE0z
- TLSH
  T196D41923EB590AA0D091D3B851874742E7F1BC158B21EBC752EBE26D2F277C5A23B750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  msvcp140_1.dll
- Size 34KB
- SHA256 91cd05c16c61c39788c47434602a59c17f5b08dbb3eee04ce85f8d5b70e8e604
- MD5 34a0ee0318a6be3f4a17826e5c17f8e3
- SHA1 5b252d10138d6666892ca9da1e1d95af24de1097
- SHA512 ffd28202e3dd91b89b7d3161f33243e52e8a0b59d31d917c3cd0005c1e97cc818d1ebba9a4971e602164d31b42448c8fef8d0204618ef4134255876c7bd7fe5b
- SSDEEP 384:zLjh/2cARG7SIXvQ7Q9Ra09dSvWcV5gWWBCSt+eiBHR9z12zfq5yEFHRN7m3hR9i:XlWRGu7QHa0PSxadQr9zjgElmb9ze
- TLSH
  T1A0F25B95AB288042ECAB583086AADD833C3DB7D25B51D6DB1391F51C0CA33C6FA3563D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  msvcp140_2.dll
- Size 262KB
- SHA256 713f17b253d802d283d306ce75647e37d83a546aeb1a881e5d9e529e856c007e
- MD5 0c462afe7502e3646086ea7783022c11
- SHA1 b5a6f2d00b7903cf8f4d2ff26980e2ae612ade1e
- SHA512 6b30815c46bd54778e649aea48f8de64b4b7c49123060737a0cbdb13888669672aeef244a1e16c7c8c8e0d1d2a480309f30d51d2ab11c4debb3ea67f9337e0d6
- SSDEEP 6144:qwJ2pjLMT2arwMnwn3Veu7nqZC9JF7WYuWix7ZA:WaTQ3Veu7+cvWvW/
- TLSH
  T15544281276192EBFC8E7A8B04539B412FC2A36514731C48A1BC31C4DAF1BA577EE356E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  msvcr120.dll
- Size 940KB
- SHA256 ad32240bb1de55c3f5fcac8789f583a17057f9d14914c538c2a7a5ad346b341c
- MD5 9c861c079dd81762b6c54e37597b7712
- SHA1 62cb65a1d79e2c5ada0c7bfc04c18693567c90d0
- SHA512 3aa770d6fba8590fdcf5d263cb2b3d2fae859e29d31ad482fbfbd700bcd602a013ac2568475999ef9fb06ae666d203d97f42181ec7344cba023a8534fb13acb7
- SSDEEP 24576:FkZ+EUPoH5KTcAxt/qvRQdxQxO61kCS9mmWymzVPD:FkMAlM8ixQI5C6wl
- TLSH
  T10525BE4676A106FAD463D2B4C9A79607E2B2B85B1530D7AF02E0866D3F23B30975F317
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  vccorlib120.dll
- Size 348KB
- SHA256 602add77cbd807d02306de1d0179cb71a908eecb11677116fc206a7e714ab6d6
- MD5 bdd8ae768dbf3e6c65d741cb3880b8a7
- SHA1 91b01fd48a586822c1d81ca80b950f8639cce78c
- SHA512 7840554a66f033e556cf02772b8b3749c593657ca254e0f2dbd93b05f4600e11ba821eba8fc038115c038b5e5af2f8d2cf0a5ae1f1362e813cf0b5041bbbff94
- SSDEEP 6144:0g5dgFfqaKFJyHrByeUIRAHq0KzS9OAgfVgYCDlSv:0OdcUIRAHqAeX0a
- TLSH
  T1C3741A127BA88CE3D43391764AA78B45E7B2B8920F71E30B2594432E5F773616C1F672
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  vccorlib140.dll
- Size 386KB
- SHA256 8a442077df17ac412be9072a91e4b2b39a69f1aed189034d34fdd79956d3d6b6
- MD5 3d8e0ebbb613cbe80320a61259d18514
- SHA1 a69747866b33159ee14eecc9ac19a0ad1f1db4e5
- SHA512 83c72e2db25b86de925ad9711a03943fc4801f77d6950a23917898e877faa3276cc2c5e8605cc0132e48c1bf66cc45b172578f77d075746ac38880257e579660
- SSDEEP 6144:AjZC0tyLYDLFjjQeALc26e0KI34VRs02lpp2Wh:0ZQYDLFgvLd6K9Mp26
- TLSH
  T15484D91AFB5C4C93D83251398A97834AE3B1B8950F61D3CF25A8430E6F6B7E48C36675
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  vcruntime140.dll
- Size 83KB
- SHA256 6cadb4fef773c23b511acc8b715a084815c6e41dd8c694bc70090a97b3b03fb9
- MD5 0c583614eb8ffb4c8c2d9e9880220f1d
- SHA1 0b7fca03a971a0d3b0776698b51f62bca5043e4d
- SHA512 79bbf50e38e358e492f24fe0923824d02f4b831336dae9572540af1ae7df162457d08de13e720f180309d537667bc1b108bdd782af84356562cca44d3e9e3b64
- SSDEEP 1536:ikqwmvKrSgB91BDJ25Tg/G0G5r4Gt7qNBPS9DH6ecboHjPxu+dBsi6:i3CuavtckJSVqNBPSUecboHjPx/O
- TLSH
  T15A838C4567E802B6E06B9130C0E28E47FB76B485877047DF037A56AE1F53BE18B3AB51
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  vcruntime140_1.dll
- Size 36KB
- SHA256 04e7ccbdcad7cbaf0ed28692fb08eab832c38aad9071749037ee7a58f45e9d7d
- MD5 7667b0883de4667ec87c3b75bed84d84
- SHA1 e6f6df83e813ed8252614a46a5892c4856df1f58
- SHA512 968cbaafe416a9e398c5bfd8c5825fa813462ae207d17072c035f916742517edc42349a72ab6795199d34ccece259d5f2f63587cfaeb0026c0667632b05c5c74
- SSDEEP 384:5InvMCmWEyhUcSLt5a9k6KrOE5fY/ntz5txWE6Wc+XfbmuncS74GdWrUKWj14gHg:dCm5yhUcwrHY/ntTxT6ovR7VxIV1z
- TLSH
  T172F24A8167788096E46B95B0C4A35F27FB38F9616750938F0BA4825D2F637D0F63E31A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22