valleyrat_s2 | 6b18dcd71baaeab6c499f3409ccbcc55da37a7f8a901f628dc55698ea3b4b73c

Sharing

Copy URL Twitter E-mail

General

Target
axjc1xuq6rbEmfNAnMvMVdo3p-ipAfYo3FVpjqO0tzw.bin
Size 1.9MB
Sample261027-xd9kwaec66
SHA256 6b18dcd71baaeab6c499f3409ccbcc55da37a7f8a901f628dc55698ea3b4b73c
MD5 634eb2c64efc0e3ac032ca90e4505fa5
SHA1 3dc96dbfc9278eac5f7f8060e0352c1aeb49013f
SHA512 80cecad1fe2eb8e9e6f40e32b564d3afa0950ca6bdedfff76404749d1f2539d4029da7cfce905f6bea270f79a28e655cd2370ddc74784e627481b07ed3ac646d
SSDEEP 49152:ENeRK1D2GnnFpy+YXFR3/RBWa6y/2i2osMhLIjPmxv/66LU2bAG:ENIK0Gn/y+UR35B1LtskLI+Cv9G
TLSH
T1BF95332AE8DCCD5E6C3CAF6CB53981DB16FD4231C2746EC27889151C5CA5B4AAC379B0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

valleyrat_s2

Version

204.194.49.108:21107

Targets

- Target
  20261027.22367819.C8A41F9D8851.exe
- Size 343KB
- SHA256 6d3fee81ad1339b8e9a2ae7d24669fc9ad9ec84c3b13932289fb20a25bce5596
- MD5 a8c9c91d9f556ddc4c3dee2e7af7c140
- SHA1 05cd34af731e5f29a9fe5b7950c25450a893b20e
- SHA512 3aace6b6ac91b50bff730a2a01c1c1fc7ee50b932d1464b82ff2b3ea265b033c5b67067a92f1968dd56f619a22f0ab75ad28311a6c0ce73a352a03f3120472fc
- SSDEEP 6144:yheV9dmppO7+6q4XZ5iNmlRO2Wst9t+jX:yh6h+KTDRWsntu
- TLSH
  T1CF743C933B5A1C96F897C0394657BE02EB727C990312C6DBA360B55A5F3B6E03D78E10
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery valleyrat_s2 persistence spyware trojan
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- UAC bypass
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
behavioral1 behavioral2
- Target
  appshare.dll
- Size 3.3MB
- SHA256 7c16cd83296daa3daeaabd495bfcdac82fe1b6d4a91bf1285291107b0bf5fd94
- MD5 6cfeb0da1b0528588644172f1e58b71e
- SHA1 bdffc973017fce17636196403dfc9dd7ac41dd9b
- SHA512 cd110e41ab6a2468cd2d4a4a2a7932dcfaed28927dabc04494dcdbffabf42a39cae9e026859863f1ad127971d06a1510b6ba178b21677f238284991efd3da6bb
- SSDEEP 12288:1R4kb9UnQDBDvy2uV8JzMXmMDsZecYWwK3Lf15l6f+1jWZ+/Pah9R3DimFHIe/6M:KMBfd16f+1jWZ+/PazjUs4dk
- TLSH
  T160F5DC1039EFD07AA377AAA56FD8B99AD89FE132654B74D730421F078233CC4DA11879
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  mediastores.dll
- Size 248KB
- SHA256 02f7f062d9065e15b064afd94137da0723ac19db953733800ea3a04394ba44b5
- MD5 30d90bec43a43d238788d2ecd4b0d2b8
- SHA1 04d2ee43de24b328cece7a530472b19e19a39319
- SHA512 d1155b4278a2ffa4d49b8698c7e89ae638ec82fffe08e901c87b37b1527a3ec5507261183ba85492721dfe432f215701f53d33fb201de8087bf0332c88c8f054
- SSDEEP 3072:P4rdtoPiLB+aInY5cGqKZKi1Ncho0fUf+M6uINQkd1q2M3vETo/jK5oIQ28xwR:tqLAaInilT4zUfv6uqt1q2WET+fxy
- TLSH
  T1BA44294B665408F7D8ABD17C89878A07EBB2391A4351D7CF07D0965A0F0B7E1BE3AB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  msvcp140.dll
- Size 553KB
- SHA256 3048df1cf8d476e998dde28ed6b67856b47ec5ae2b2c221fb1733f43c550c701
- MD5 e3791c5b54bd3f1d2a61b1beff9ef5f2
- SHA1 f55535eff838a93bcab300673e93447c3d0a54ef
- SHA512 14931c8e05484989bdbea942f797b0e3d1ef6fb1e60a47b30f3f84b56adc35e18a3c7943004f75e96fbf1a2d5df0452b2511a18418705b3c84c57f2d11b11c04
- SSDEEP 12288:0Tv2OuTt6DRh4l0PU+tDLjfhQEKZm+jWodEEVT6um:0FU+1hQEKZm+jWodEExZm
- TLSH
  T186C41923B75905A0E195E3B891838705D7F07C4A8322A3C792FBD5AE2F5B7D1A73B250
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  msvcp140_1.dll
- Size 25KB
- SHA256 086e083da4e7a46438aff3188beb2c0d14cb38af216c62a880cd8209dfcfcca8
- MD5 6e10c7dff6c6f55ba43c784037958341
- SHA1 82afedb28493bff8ba462d0bb012fdc35d25984e
- SHA512 6135353999206fc1f8b9bc52fa2383ef86d999a0d903c2806a3f621cc68c34241ace70c8c86f6589dc41d84ace5d79ca46f8ba83334434826088dc4d29bfc8de
- SSDEEP 384:mDN8AFcc1nOx9dq/1Wc15gWWCr2VHRN7dFDtdQ5R9zrjdb:mZPFccIxPq/TJOdDds9zvJ
- TLSH
  T196B25B86EB14C846ED564830C99ADE436A39B7D41B50A7CF1395BA1C0DE33C2FE35A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  msvcp140_2.dll
- Size 252KB
- SHA256 5fd1bf62b065bd9a8bcbf8552d9ffd24f96341c10a4b93c5be0282a2f704fb2e
- MD5 15c26b825ab7dcd52472746fa0f3cb1f
- SHA1 7ad10975109e2003b1d7ea10cd98a22cde8b8dfe
- SHA512 6b2fb0a880b28e3fb939280dab52a5a6679b5dc603c9c80457840eb81c451124b5617a4571d6ede034f6332b2b11c2b65ad62287edbec739baf83a12ad83dc6d
- SSDEEP 3072:tlNIQs3d7QsQIPxv+evBCiuxLQtDVbqyFjOqGUSHNKtdjhESjUJ2aRAAuO1UL9ZT:tzPnIPB+W9FjOq9CcrjhKJ36ve5vWY8R
- TLSH
  T1FA440716B5092FBFC8E6A4B04939B412FC2A36405731C48A16C32D4DAF1FA577EE356E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  msvcp140_atomic_wait.dll
- Size 39KB
- SHA256 d4fdd222f3f2880651edf6802bc44710a3d66c691c3afb7fe2bf3229f06ff935
- MD5 32920dc27d6663b544fa57760642ba7a
- SHA1 b819a651e97d2e07da580e7cfa468201b9304a61
- SHA512 083ad5a8db0511a9ab386342658e0b5197edcb873fd8db8f6aaa87806da8091ba980dde843eb378c201d873dab75ca1f6be47bb3607ea12d949b0f6492717bd9
- SSDEEP 768:DrulGoz1ViLdOfv+rpABXeGHasDFvR7in9zt/:qGeiaKiBXeGHasBo9zt/
- TLSH
  T1AE036C5E63A44482E46746348062A62BE7BB76E24B10D7DF5721F09E0F637D0FB34B1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  msvcp140_codecvt_ids.dll
- Size 21KB
- SHA256 109312ce9e35c66c8f411d1fc74aba902c46cd65ca40883d2eb779fb09031c33
- MD5 03243cab6858eae7faa4425c1d3e02ac
- SHA1 98c8d460ffb2d676e6ba6d7116f0b1512bcd605c
- SHA512 63e41f7193f185832304e47b42764d73c82833c327d2c3bf73fb06b3905591328da036b3746439a63582742b39ff40c7a94a4408068381e784203d8b04d3cae0
- SSDEEP 384:Z4DgP2fsle6WirEWVr2VHRN7DkELRPR9zywhFn:sgPw/onOQQ9zV
- TLSH
  T13DA26D86E6284547ECAA4870C1BECE477C7D77921A20938B13A1F0191DA33C7EB3566D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  util.dll
- Size 1.4MB
- SHA256 889c8747e20356a83f7e81c1206de869beeed3707408716656ab5b5a14451044
- MD5 1d37b895bdba65c274df607b212774eb
- SHA1 0b4ceb589c01cb9ce4a59194d2f1cec969f93f1c
- SHA512 44f25f52921ecae4256c63fe45c496c419ec509220a9dcc4bd9cea2bd2c2b3485aae581771f94cbaa3ddb38eeee7e9d18a3fb446d7b5b0f465476f3875a28f79
- SSDEEP 24576:/lYdN1TFOxYFzgq1vmz1K+M4bNclnCKqYh:9YdNdFOxnqST1bNclnj
- TLSH
  T1BB654B890246A6CAC855F53CEE42A413F3F6B911035DCEE7943184BA0F772E69A7EF41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  vccorlib140.dll
- Size 336KB
- SHA256 430accf44c39446446cf541174ad4fa4e8a25e603c389a524caf8de1606e45be
- MD5 522eff8c1303dee8bd8eb385a0c20e9b
- SHA1 5957f5d1a8509c772c15eb6de268d9b52f66dbee
- SHA512 023651994cd23a722af0c81bdc3269f6de6a16174b5ab13f447b9d248e85e008eaa19899f5023dbd65933263e671aa00477d15dbaaf47d85201fef99b942f68b
- SSDEEP 6144:aep8WHdoHDGzBb/Cpx+/hBgyzgMXxUc0J3etWGx0CttwV2eo+lLXuF560XA2eUSL:VtmJO3GgtWp1qVXAfF6mJ19Mq
- TLSH
  T18574C56B2A9C0CD3CD3160760E979309E3B278510B61A7CF1691470F5E3FBE4AE7A664
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  vcruntime140.dll
- Size 108KB
- SHA256 9593801b89cf3c0a46056f4d923d67b5c685fb8760f007b4d194e4a6a6ed9396
- MD5 41e66b1c590019dc99f544513c0693bc
- SHA1 d882329c786bd1038bbeeecc58c2f3b2a085ac22
- SHA512 8296f7e4113d4e6dbee72a7d29358a67b4ffd1e284a01a3b7fbf4e85878a07444777df6d3c2e6efdea7e7d7a1f167d7fad755f78a655cdb2b89d0330265ed611
- SSDEEP 1536:gQOierMULrYaTw+xkU4X3X6pjxP9vPOiDxvkcYYbBD4ZecbuHcTa3xzZY:g/trT2XH6POiDxMcYoKZecbuHcTUxtY
- TLSH
  T193B36B8A72A003F7D16AC239C1A32A16F771F8548760A7CF03A54A7A1F53BE15E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  vcruntime140_1.dll
- Size 38KB
- SHA256 b49a9b9c334e66bb14e0bd784be2e0a86edc7d24a9ebf90d1b2bbd71451695c9
- MD5 15e66163e8bdaaaf8bb775b29d9f98b0
- SHA1 48a854b69efa1ab9ef2ebae9b465e4b8ea415ffb
- SHA512 e9f3cd24957045ecd2fe9e175de2909474ce9c69b2c81e4575e965ab4e7b34d7ea7eef3071079b0a176ed67ca2324423b57189713b8d9312804f24dabf1a4ca8
- SSDEEP 384:QHbrv6WeyJSGeWuh1fD/Hk+GlbjWyIhHz6Yf2Q1mPOw6U8z3WrfKWdtT7nHRN76L:zWeMk/D/HunfmHz6SC8MD1Q9zVp
- TLSH
  T14E034B9467B84086E0AF91B4C4D76F17BA7CF9650B50938F0BA1919C2F637D0AB3E316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  vcruntime140_threads.dll
- Size 27KB
- SHA256 2f2709047b2e0ec13e4e344f0a044453880fb179522f995d848589ad5e31637f
- MD5 197eeb94fec5cd4e82a04005dcf2fe47
- SHA1 d7dd929f853f1edabc8680c91abf38b6eeb6a197
- SHA512 a8df4e656012240572b4de241a285ae9d2a09f135d8b51b104faa00fb50f2480c7178e158e6a1f38705c61ecbd39dbcd6edaf35734fdc0a1d7d78109baf5ebfd
- SSDEEP 384:LD5EQ+DbxF4y+LMVHWzj27Z9gf3moarJcpWrj+W6r2VHRN7EoJR9zRF:LD5EQoVHOj263mo0paOz9zP
- TLSH
  T123C28E86AB6484D6D5EB4470C5BAD947ED79FA920B1082CF03C0FA890E773C2E93971D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26