valleyrat_s2 | 2026-09-30_2fb43e665156aa6153b0f6ec8ece9ce8_amadey_elex_karagany_rhadamanthys_smoke-loader

Sharing

Copy URL Twitter E-mail

General

Target
2026-09-30_2fb43e665156aa6153b0f6ec8ece9ce8_amadey_elex_karagany_rhadamanthys_smoke-loader
Size 108KB
Sample260930-psnb7awvas
SHA256 a9c759ea8ea13df937b0d7dc7971aec13028f8953a26c620c2f6b7009fb9fea8
MD5 2fb43e665156aa6153b0f6ec8ece9ce8
SHA1 502992ca97b2f25d5eb721c67f89547b34b10353
SHA512 0810279d5d6715306387bf0287e4ba7d25641b3087f1105fc84d66b67ae44ff05828f04af3b5ea5d0d0bcce2a07190e4666233d6833d12c30415843cdbeaaf07
SSDEEP 3072:y1iqoHq83FphFFwYNCHjUE60z68XEPK/:y1izq83RwYNHX31y
TLSH
T111B37C2172E0C072C093253159F9EBB24A7EF83117B855CBB7E816BA5F603C16A7535B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor valleyrat_s2

Malware Config

Extracted

Family

valleyrat_s2

Version

108.187.43.94:443
108.187.43.94:80
127.0.0.1:80

Attributes

campaign_date
2026. 9.28

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-30_2fb43e665156aa6153b0f6ec8ece9ce8_amadey_elex_karagany_rhadamanthys_smoke-loader

File Explorer

2026-09-30_2fb43e665156aa6153b0f6ec8ece9ce8_amadey_elex_karagany_rhadamanthys_smoke-loader

.exe 108KB

2026-09-30_2fb43e665156aa6153b0f6ec8ece9ce8_amadey_elex_karagany_rhadamanthys_smoke-loader

IMPHASH b8bf08fa843a9ec1ce10d80fbf550c26
SHA256 a9c759ea8ea13df937b0d7dc7971aec13028f8953a26c620c2f6b7009fb9fea8
MD5 2fb43e665156aa6153b0f6ec8ece9ce8
SHA1 502992ca97b2f25d5eb721c67f89547b34b10353
SHA512 0810279d5d6715306387bf0287e4ba7d25641b3087f1105fc84d66b67ae44ff05828f04af3b5ea5d0d0bcce2a07190e4666233d6833d12c30415843cdbeaaf07
SSDEEP 3072:y1iqoHq83FphFFwYNCHjUE60z68XEPK/:y1izq83RwYNHX31y
TLSH
T111B37C2172E0C072C093253159F9EBB24A7EF83117B855CBB7E816BA5F603C16A7535B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30947

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InitializeCriticalSectionAndSpinCount HeapDestroy LeaveCriticalSection HeapCreate EnterCriticalSection DeleteCriticalSection WaitForSingleObject SetEvent Sleep CreateEventA GetLastError CloseHandle GetCurrentThreadId SwitchToThread SetLastError WideCharToMultiByte lstrlenW InterlockedExchange ResetEvent CreateEventW CancelIo TryEnterCriticalSection SetWaitableTimer CreateWaitableTimerW GetThreadContext InterlockedCompareExchange OpenProcess GetFileAttributesA GetExitCodeProcess CreateProcessA GetSystemDirectoryA VirtualAllocEx WriteProcessMemory ResumeThread FreeLibrary SetUnhandledExceptionFilter GetCurrentProcess LoadLibraryW GetConsoleWindow CreateFileW GetProcAddress GetLocalTime IsDebuggerPresent GetCurrentProcessId CreateThread LCMapStringW WriteConsoleW SetStdHandle GetStringTypeW MultiByteToWideChar HeapFree InterlockedDecrement InterlockedIncrement HeapAlloc VirtualAlloc SetThreadContext VirtualFree IsValidCodePage FlushFileBuffers GetOEMCP GetACP GetCPInfo GetConsoleMode GetConsoleCP SetFilePointer RtlUnwind GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter GetStartupInfoW GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW TlsFree TlsSetValue TlsGetValue TlsAlloc HeapReAlloc HeapSize GetProcessHeap ExitThread DecodePointer EncodePointer GetCommandLineW HeapSetInformation RaiseException TerminateProcess UnhandledExceptionFilter IsProcessorFeaturePresent GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameW

user32

DispatchMessageW PostThreadMessageA PeekMessageW TranslateMessage MsgWaitForMultipleObjects ShowWindow GetInputState wsprintfW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteValueW RegQueryValueExW RegCreateKeyW RegSetValueExW

ws2_32

WSAWaitForMultipleEvents WSAIoctl connect WSAStartup select WSAResetEvent setsockopt WSACleanup recv socket closesocket send WSASetLastError WSACreateEvent shutdown WSAEventSelect WSAEnumNetworkEvents WSAGetLastError WSACloseEvent htons gethostbyname

winmm

timeGetTime