valleyrat_s2 | d4665762c6f9abd383400d60afda52b0a732e883c8b651fb6804df941428054e

General

Target
d4665762c6f9abd383400d60afda52b0a732e883c8b651fb6804df941428054e
Size 5.8MB
Sample261014-s8shmafs8x
SHA256 d4665762c6f9abd383400d60afda52b0a732e883c8b651fb6804df941428054e
MD5 9bb55024656503f71724325c7814c941
SHA1 989a4a60cb9848b02745d7a70e0f6312ade0154b
SHA512 67283639675a960e2cd5df587ebd412611031915ba2e85bcfe8679e2bb16b22e628b2dc9e98377c2c9810b9f3f7af65964011cab95569f111c7986fd375d1098
SSDEEP 98304:djBty0g5LwR3Xv7Rfq4K6z0ShZaLQ2RC6cwmU3E1my7N0OF:djBtnvVm4hZgQ2oiFuD7
TLSH
T13A56CF577AF840BAC8A3C179C66B8A9FE3F274110D31961F9295474A6F37B61CE0B321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  d4665762c6f9abd383400d60afda52b0a732e883c8b651fb6804df941428054e
- Size 5.8MB
- SHA256 d4665762c6f9abd383400d60afda52b0a732e883c8b651fb6804df941428054e
- MD5 9bb55024656503f71724325c7814c941
- SHA1 989a4a60cb9848b02745d7a70e0f6312ade0154b
- SHA512 67283639675a960e2cd5df587ebd412611031915ba2e85bcfe8679e2bb16b22e628b2dc9e98377c2c9810b9f3f7af65964011cab95569f111c7986fd375d1098
- SSDEEP 98304:djBty0g5LwR3Xv7Rfq4K6z0ShZaLQ2RC6cwmU3E1my7N0OF:djBtnvVm4hZgQ2oiFuD7
- TLSH
  T13A56CF577AF840BAC8A3C179C66B8A9FE3F274110D31961F9295474A6F37B61CE0B321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence ransomware rat spyware stealer trojan
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- DCAgent remote management tool
  DCAgent is part of ManageEngine, a remote administration tool that can be used as a backdoor
  backdoor rat
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Drops file in System32 directory
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral1 behavioral2