valleyrat_s2 | 832034bf8ace35b74d62eb0b114134778a128cfb1b8af1f2ec67310f01ff4175

General

Target
New Tax Filing Regulations.iso
Size 768KB
Sample261014-pmesvsvwev
SHA256 832034bf8ace35b74d62eb0b114134778a128cfb1b8af1f2ec67310f01ff4175
MD5 310fdaa120c224aff19199f823a756bd
SHA1 8395c90821bbb8bbb4ea13bc08378b5b13af72b3
SHA512 814b0ac79268ef603f8d30c573f1111b95d6a8e84d6a5c05231f1f1323aa4b94ed9d9f292d4cd9b8b6e9787e097ed76a200ed5cb5416b1168848863ff7ef8f1d
SSDEEP 12288:sKTr92i/qCDrWz88MsbP0cyWaQ8ck8cLqR9TjxSJrX:BVyuWg8Mk7Qck8cLG9TjxSJ
TLSH
T1DBF4D04AF7A459FAE0AAC138C9538506E7727C8A0761D79F33AC466B2F232E05D3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

valleyrat_s2

Version

1.0

C2

8.210.231.207:9090
8.210.231.207:6666

Targets

- Target
  New Tax Filing Regulations.exe
- Size 367KB
- SHA256 a150614db8802e3700db945c42f7e9c2fb03cfdcbea7854b0b072a2e35a11b77
- MD5 d455b3b0529d73929fb2f2ecd43b4f75
- SHA1 934549d96c0d836579d0ffd0d8c580ecbcd87b65
- SHA512 b490795b2bf54e1edb0d1f7075cf9c58fc7255e0ecef0ebce499ad42945700e2237421196f57880b92f7e3d036ee9b95354c9157d3f3b3a9a7fd65ff7d9c0952
- SSDEEP 6144:UK0CMcoPY19CebAiwu6B36NDrd8zzJ6aFMMkxGbP0cw:UKTr92i/qCDrWz88MsbP0cw
- TLSH
  T1EC849D46F7A418F5E0A7C139C9628906E7727C9A0770CBCF23A4466B2F272E15D3D762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence privilege_escalation ransomware
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  VSPMsg.dll
- Size 348KB
- SHA256 008c571e964f6ca718f5ae483c71ca5c19d9251821156e3f8910af395c6c10f8
- MD5 e9bf2dc3a51626f0deaaade490e895d3
- SHA1 8b1aa946bd16467a8beeb3cc22bd7e134914be66
- SHA512 d895c93601f459d5b2fb7aedf68bfdd48b36dc8836647aa10fd7e4a460cd7e09a8e2a8379daaa47b7f6ec5ad66d08c63776714a12fc0007230fce0bb9474bf9e
- SSDEEP 6144:lFhP4JAitXUoAZusGk8DgLuHbRhPph4X+13GB3z92n1EnJX:nWaQ8ck8cLqR9TjxSJrX
- TLSH
  T19D74121EDB42E6EFEC985534DD5B52AB962EE8840595703D53EC253FDCB0ABC243CA08
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence privilege_escalation ransomware
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4