valleyrat_s2 | 7d29ced5762d7c3d12613f14002785be0959291703bfce2004c0d7578d557178

Sharing

Copy URL Twitter E-mail

General

Target
7d29ced5762d7c3d12613f14002785be0959291703bfce2004c0d7578d557178
Size 498KB
Sample261003-lae2bavfqa
SHA256 7d29ced5762d7c3d12613f14002785be0959291703bfce2004c0d7578d557178
MD5 991f11f0056538e3fbe5a0904210479b
SHA1 da3abee64491d82c23d5755a448e5116afe38072
SHA512 c51496a91754ea411e55a9accaf02d97fb91b19947e962ab401b6aa1b62c5962943ecf65576c656ad8d66fb24c63579b33ca53cd240dd1b7c47b60f81fd1fe82
SSDEEP 12288:G/Zt/IbduvOrYVi3kiaY2w4CcfQQRfQvs:G/Zt/IbYvxip2wZiNRs
TLSH
T150B4071235AAE871C1798E309F39E7F5B25DBE700B6185DB33C40E294DBC0D27A257A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor valleyrat_s2

Malware Config

Extracted

Family

valleyrat_s2

Version

47.243.112.74:8080
47.243.112.74:8181
43.112.74:8282

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7d29ced5762d7c3d12613f14002785be0959291703bfce2004c0d7578d557178

File Explorer

7d29ced5762d7c3d12613f14002785be0959291703bfce2004c0d7578d557178

.exe 498KB

7d29ced5762d7c3d12613f14002785be0959291703bfce2004c0d7578d557178

IMPHASH 3fe4f22d429a844e0c88335497c8c9ad
SHA256 7d29ced5762d7c3d12613f14002785be0959291703bfce2004c0d7578d557178
MD5 991f11f0056538e3fbe5a0904210479b
SHA1 da3abee64491d82c23d5755a448e5116afe38072
SHA512 c51496a91754ea411e55a9accaf02d97fb91b19947e962ab401b6aa1b62c5962943ecf65576c656ad8d66fb24c63579b33ca53cd240dd1b7c47b60f81fd1fe82
SSDEEP 12288:G/Zt/IbduvOrYVi3kiaY2w4CcfQQRfQvs:G/Zt/IbYvxip2wZiNRs
TLSH
T150B4071235AAE871C1798E309F39E7F5B25DBE700B6185DB33C40E294DBC0D27A257A6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

133508

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapReAlloc RaiseException HeapAlloc DecodePointer DeleteCriticalSection GetProcessHeap EnterCriticalSection LeaveCriticalSection ResumeThread OpenProcess GetFileAttributesA GetSystemDirectoryA CloseHandle GetThreadContext VirtualAllocEx CreateProcessA SetThreadContext GetExitCodeProcess WaitForSingleObject SetEvent CreateEventA ReleaseSemaphore GetCurrentThreadId GetLastError SetLastError CancelIo InterlockedExchange lstrlenW CreateEventW ResetEvent WideCharToMultiByte GetModuleFileNameA FindFirstFileA FindNextFileA FindClose CreateFileW MoveFileExA CreateThread GlobalMemoryStatusEx GetConsoleWindow WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW Sleep HeapSize InitializeCriticalSectionAndSpinCount VirtualAlloc VirtualFree SwitchToThread HeapFree GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType GetACP GetCommandLineW GetCommandLineA WriteFile GetStdHandle ExitProcess GetModuleHandleExW ExitThread RtlUnwind LoadLibraryW UnregisterWaitEx IsDebuggerPresent OutputDebugStringW QueryPerformanceCounter QueryPerformanceFrequency TryEnterCriticalSection DuplicateHandle WaitForSingleObjectEx GetCurrentProcess GetCurrentThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount GetModuleHandleW GetProcAddress MultiByteToWideChar EncodePointer GetCPInfo CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead TerminateProcess CreateTimerQueue SignalObjectAndWait SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibrary FreeLibraryAndExitThread GetModuleFileNameW GetModuleHandleA LoadLibraryExW GetVersionExW VirtualProtect InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList

user32

PostThreadMessageA GetCursorPos GetInputState ShowWindow

advapi32

RegCloseKey RegSetValueExW RegOpenKeyExW RegCreateKeyW RegDeleteValueW RegQueryValueExW

ws2_32

WSACleanup WSAIoctl closesocket gethostbyname select WSAGetLastError send socket connect recv htons setsockopt getnameinfo ioctlsocket freeaddrinfo getsockopt ntohs getpeername getaddrinfo WSASocketW shutdown __WSAFDIsSet WSAStartup

winmm

timeGetTime