valleyrat_s2 | 5ebee19637f4552590ff6deede030abb30569d807e1ffbd421c90e1c493ed94c

Sharing

Copy URL Twitter E-mail

General

Target
5ebee19637f4552590ff6deede030abb30569d807e1ffbd421c90e1c493ed94c
Size 8.3MB
Sample261020-jca42aay9k
SHA256 5ebee19637f4552590ff6deede030abb30569d807e1ffbd421c90e1c493ed94c
MD5 46b59da275c32c266bdf6849c3c8eb43
SHA1 194da741995f5421299e0b26caa4702f1e953984
SHA512 869158eba42baeffca41b6f82b44b27f1b17e7f85323a34809a841518b6ea3914f2f4d62149f1d235989192cc55738d66c0e6f93b1f7b3a0b0e4f5e3a7ba766e
SSDEEP 98304:6MIWL8+7xg8/zzjyzUydHo6n6l6aaeFCq4eFPlA3aRLQ1Xo2NTauZrFvJqPD:64L82Rb36n6lp+aVe1TakrFRq
TLSH
T101968D12FA41C137D789053034EEB77A8C39BE2C072050C7AE96FA1B5D705E276BE65A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor valleyrat_s2

Malware Config

Extracted

Family

valleyrat_s2

Version

154.39.252.130:8080
154.39.252.130:8181
39.252.130:8282

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ebee19637f4552590ff6deede030abb30569d807e1ffbd421c90e1c493ed94c

File Explorer

5ebee19637f4552590ff6deede030abb30569d807e1ffbd421c90e1c493ed94c

.exe 8.3MB

5ebee19637f4552590ff6deede030abb30569d807e1ffbd421c90e1c493ed94c

IMPHASH 692293121a09bea97d4b46a2ec2831d8
SHA256 5ebee19637f4552590ff6deede030abb30569d807e1ffbd421c90e1c493ed94c
MD5 46b59da275c32c266bdf6849c3c8eb43
SHA1 194da741995f5421299e0b26caa4702f1e953984
SHA512 869158eba42baeffca41b6f82b44b27f1b17e7f85323a34809a841518b6ea3914f2f4d62149f1d235989192cc55738d66c0e6f93b1f7b3a0b0e4f5e3a7ba766e
SSDEEP 98304:6MIWL8+7xg8/zzjyzUydHo6n6l6aaeFCq4eFPlA3aRLQ1Xo2NTauZrFvJqPD:64L82Rb36n6lp+aVe1TakrFRq
TLSH
T101968D12FA41C137D789053034EEB77A8C39BE2C072050C7AE96FA1B5D705E276BE65A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

497882

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateEventA CloseHandle Sleep WaitForSingleObject SetEvent GetCurrentThreadId InterlockedExchange CreateEventW CancelIo WideCharToMultiByte lstrlenW ResetEvent GetExitCodeProcess OpenProcess ResumeThread SetThreadContext VirtualAllocEx CreateProcessA GetFileAttributesA GetSystemDirectoryA WriteFile CreateFileW Process32NextW Process32FirstW CreateToolhelp32Snapshot GetUserDefaultUILanguage GetTickCount64 SetErrorMode FreeLibrary GetProcAddress LoadLibraryW CreateThread GetConsoleWindow WinExec MoveFileExA GetModuleFileNameA GetCurrentDirectoryA GetTickCount GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess HeapSetInformation InterlockedCompareExchange VirtualAlloc GetThreadContext VirtualFree DecodePointer EncodePointer GetSystemTimeAsFileTime

user32

ShowWindow PostThreadMessageA GetInputState MessageBoxW

advapi32

RegCreateKeyW RegOpenKeyExW RegDeleteValueW RegSetValueExW RegCloseKey RegQueryValueExW

shell32

ShellExecuteW

ws2_32

socket gethostbyname htons connect WSAIoctl select WSAStartup send setsockopt closesocket WSACleanup recv

msvcr100

_initterm_e _initterm __winitenv _XcptFilter _exit _cexit __wgetmainargs _amsg_exit _onexit _configthreadlocale _invoke_watson _except_handler4_common _crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QAEXXZ ?terminate@@YAXXZ __set_app_type _fmode _commode _controlfp_s _beginthreadex ??3@YAXPAX@Z __CxxFrameHandler3 _CxxThrowException ceil memcpy memmove memset ??2@YAPAXI@Z wcscpy_s ??_V@YAXPAX@Z _errno _lock vsprintf_s _wcsrev exit printf printf_s _wtoi sprintf _unlock __dllonexit __setusermatherr

winmm

timeGetTime