valleyrat_s2 | 2026-10-16_5a6c2e9b135c7619aefec860880bef55_cobalt-strike_icedid_luca-stealer_njrat

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-16_5a6c2e9b135c7619aefec860880bef55_cobalt-strike_icedid_luca-stealer_njrat
Size 192KB
Sample261017-val93aga26
SHA256 13d5ae6e80d4c87bad58a901a188c735257fcd388da5521c0b28cd83f50ec35f
MD5 5a6c2e9b135c7619aefec860880bef55
SHA1 a7faf4e190358c72398fcedfa88f39e31e74c7ac
SHA512 6330a605ff85c6af2807a575ab122aa150b9e67383d09f7a1267085211b54e109c45233ef1ebe19e2ad2809397f0a936479c3c1341fd8bee89597426e52f4433
SSDEEP 3072:K/QA34A4K35VvcqblytTUvYPYmfOxImFnZfm9H5x9/ET6G5LwRmURAH:ob4K3hhoQvYPPOmY5m9Gb4Q
TLSH
T117146B49B7E500F9D073823989914657F773B8151760ABDF07A0837AAF23AD4AD3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor valleyrat_s2

Malware Config

Extracted

Family

valleyrat_s2

Version

li.lililililili.li:11111
127.0.0.1:80

Attributes

campaign_date
LI_O YG

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-10-16_5a6c2e9b135c7619aefec860880bef55_cobalt-strike_icedid_luca-stealer_njrat

File Explorer

2026-10-16_5a6c2e9b135c7619aefec860880bef55_cobalt-strike_icedid_luca-stealer_njrat

.exe 192KB

2026-10-16_5a6c2e9b135c7619aefec860880bef55_cobalt-strike_icedid_luca-stealer_njrat

IMPHASH 41732eb07837bfb146ccc121dc0d2cfc
SHA256 13d5ae6e80d4c87bad58a901a188c735257fcd388da5521c0b28cd83f50ec35f
MD5 5a6c2e9b135c7619aefec860880bef55
SHA1 a7faf4e190358c72398fcedfa88f39e31e74c7ac
SHA512 6330a605ff85c6af2807a575ab122aa150b9e67383d09f7a1267085211b54e109c45233ef1ebe19e2ad2809397f0a936479c3c1341fd8bee89597426e52f4433
SSDEEP 3072:K/QA34A4K35VvcqblytTUvYPYmfOxImFnZfm9H5x9/ET6G5LwRmURAH:ob4K3hhoQvYPPOmY5m9Gb4Q
TLSH
T117146B49B7E500F9D073823989914657F773B8151760ABDF07A0837AAF23AD4AD3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

39260

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

HeapAlloc HeapDestroy DeleteCriticalSection GetProcessHeap HeapCreate EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection WaitForSingleObject Sleep SetEvent CloseHandle CreateEventA GetCurrentThreadId SwitchToThread SetLastError CancelIo lstrlenW CreateEventW ResetEvent WideCharToMultiByte TryEnterCriticalSection SetWaitableTimer CreateWaitableTimerW WriteProcessMemory HeapReAlloc OpenProcess OutputDebugStringW GetSystemDirectoryA GetThreadContext VirtualAllocEx CreateProcessA SetThreadContext GetExitCodeProcess GetCurrentProcess CreateFileW CancelWaitableTimer LoadLibraryW CreateThread GetLocalTime GetProcAddress GetCurrentProcessId FreeLibrary GetConsoleWindow IsDebuggerPresent SetUnhandledExceptionFilter WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetStringTypeW SetStdHandle SetEnvironmentVariableW GetLastError HeapSize InitializeCriticalSectionEx VirtualAlloc VirtualFree ResumeThread HeapFree FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetFileType FlsAlloc

user32

ShowWindow TranslateMessage PeekMessageW DispatchMessageW MsgWaitForMultipleObjects wsprintfW GetInputState PostThreadMessageA

advapi32

RegSetValueExW RegOpenKeyExW RegCreateKeyW RegDeleteValueW RegQueryValueExW RegCloseKey

ws2_32

closesocket gethostbyname select WSAIoctl send socket connect recv htons setsockopt WSAGetLastError WSAEnumNetworkEvents WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSASetLastError WSACreateEvent WSACloseEvent shutdown WSAStartup WSACleanup

winmm

timeGetTime

Name

.text

Size

124KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2026-10-16_5a6c2e9b135c7619aefec860880bef55_cobalt-strike_icedid_luca-stealer_njrat

kernel32

user32

advapi32

ws2_32

winmm

generic