valleyrat_s2 | 2026-10-14_3706acee277c4ffea87e665e772b8be1_elex_kwampirs_mafia_rhadamanthys_stealc_stop_tofsee

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-14_3706acee277c4ffea87e665e772b8be1_elex_kwampirs_mafia_rhadamanthys_stealc_stop_tofsee
Size 156KB
Sample261014-3prr4acw91
SHA256 3aa14ad8cb71792262eb065b2ab7817a0db5f937307fd377d73e4b8def09abeb
MD5 3706acee277c4ffea87e665e772b8be1
SHA1 f1db764b626f7d12c5d6133af61823059b29c645
SHA512 b1c237fd10e09555e29f035c5f16180e2dc5a5f421e24bb348ea06f6200a6d1baa41b4a3539cc8829aeadef11efbe5f11db8363251b4b00ff1f1bf300b19092e
SSDEEP 3072:p2AdKriweGVg6NZfJmdiS0cF3JSGug0bLaSCNXEpKWea:p2AdKreGVVTxmdiISGX0bLaS70
TLSH
T133F37B2136E0C073D153213989F5DBB28E6EBCB20B6555DB6BD50B7E1F302D29A3835A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor valleyrat_s2

Malware Config

Extracted

Family

valleyrat_s2

Version

43.229.112.98:6667

Attributes

campaign_date
2026.10.11

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-14_3706acee277c4ffea87e665e772b8be1_elex_kwampirs_mafia_rhadamanthys_stealc_stop_tofsee

File Explorer

2026-10-14_3706acee277c4ffea87e665e772b8be1_elex_kwampirs_mafia_rhadamanthys_stealc_stop_tofsee

.exe 156KB

2026-10-14_3706acee277c4ffea87e665e772b8be1_elex_kwampirs_mafia_rhadamanthys_stealc_stop_tofsee

IMPHASH 1fdaeb54e1a420b9565bb2d23869778b
SHA256 3aa14ad8cb71792262eb065b2ab7817a0db5f937307fd377d73e4b8def09abeb
MD5 3706acee277c4ffea87e665e772b8be1
SHA1 f1db764b626f7d12c5d6133af61823059b29c645
SHA512 b1c237fd10e09555e29f035c5f16180e2dc5a5f421e24bb348ea06f6200a6d1baa41b4a3539cc8829aeadef11efbe5f11db8363251b4b00ff1f1bf300b19092e
SSDEEP 3072:p2AdKriweGVg6NZfJmdiS0cF3JSGug0bLaSCNXEpKWea:p2AdKreGVVTxmdiISGX0bLaS70
TLSH
T133F37B2136E0C073D153213989F5DBB28E6EBCB20B6555DB6BD50B7E1F302D29A3835A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

42203

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InitializeCriticalSectionAndSpinCount HeapDestroy LeaveCriticalSection HeapCreate EnterCriticalSection DeleteCriticalSection WaitForSingleObject SetEvent Sleep CreateEventA GetLastError CloseHandle GetCurrentThreadId SwitchToThread SetLastError WideCharToMultiByte lstrlenW InterlockedExchange ResetEvent CreateEventW CancelIo TryEnterCriticalSection SetWaitableTimer CreateWaitableTimerW GetThreadContext InterlockedCompareExchange OpenProcess GetFileAttributesA GetExitCodeProcess CreateProcessA GetSystemDirectoryA VirtualAllocEx WriteProcessMemory ResumeThread FreeLibrary SetUnhandledExceptionFilter GetCurrentProcess LoadLibraryW GetConsoleWindow CreateFileW GetProcAddress GetLocalTime IsDebuggerPresent GetCurrentProcessId CreateThread WriteConsoleW IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID IsValidCodePage GetOEMCP GetACP SetFilePointer HeapFree InterlockedDecrement InterlockedIncrement HeapAlloc VirtualAlloc SetThreadContext VirtualFree ReadFile FlushFileBuffers SetStdHandle GetConsoleMode GetConsoleCP GetSystemTimeAsFileTime GetTickCount QueryPerformanceCounter GetStartupInfoW GetFileType SetHandleCount GetEnvironmentStringsW FreeEnvironmentStringsW GetLocaleInfoW TlsFree TlsSetValue TlsGetValue TlsAlloc GetModuleFileNameW GetStdHandle WriteFile HeapReAlloc HeapSize GetProcessHeap GetStringTypeW MultiByteToWideChar EncodePointer DecodePointer InitializeCriticalSection ExitThread GetCommandLineW HeapSetInformation RaiseException RtlUnwind GetCPInfo LCMapStringW TerminateProcess UnhandledExceptionFilter IsProcessorFeaturePresent GetModuleHandleW ExitProcess

user32

DispatchMessageW PostThreadMessageA PeekMessageW TranslateMessage MsgWaitForMultipleObjects ShowWindow GetInputState wsprintfW

advapi32

RegCloseKey RegOpenKeyExW RegDeleteValueW RegQueryValueExW RegCreateKeyW RegSetValueExW

ws2_32

WSAWaitForMultipleEvents WSAIoctl connect WSAStartup select WSAResetEvent setsockopt WSACleanup recv socket gethostbyname send WSASetLastError WSACreateEvent shutdown WSAEventSelect WSAEnumNetworkEvents WSAGetLastError WSACloseEvent htons closesocket

winmm

timeGetTime