valleyrat_s2 | 48631e0f414e360964698177be5aab6a9e96ebd536d2d05f8a204efbd30175a9

Sharing

Copy URL Twitter E-mail

General

Target
48631e0f414e360964698177be5aab6a9e96ebd536d2d05f8a204efbd30175a9
Size 214KB
Sample261029-1a5pass1ew
SHA256 48631e0f414e360964698177be5aab6a9e96ebd536d2d05f8a204efbd30175a9
MD5 b0396656a3b7968a8a8adca462e498b7
SHA1 4fa2878b80116e5fccbb5d48c580eea8eb402c2e
SHA512 f4bc845f6db4dd3ac34def5845f9e0a7b9da4f30e69ab21846ade82c21433c7b603d259e7941296e42ae67bef19f8092df4e13199b48bbe4ff6354cc7b59d917
SSDEEP 3072:SzIjT9hxqm1inJYxGcvcqBElY1Ju48kS4GC6v0J6Yzrm9jf50k:BhxqmLN0qOlP48uqR0
TLSH
T10E248D49B3A50CF8D4B78139C962465AEB7378450350EBDF07A0867AEF236D06D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor valleyrat_s2

Malware Config

Extracted

Family

valleyrat_s2

Version

127.0.0.1:6666
127.0.0.1:8888
127.0.0.1:80

Attributes

campaign_date
2026.10.30

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48631e0f414e360964698177be5aab6a9e96ebd536d2d05f8a204efbd30175a9

File Explorer

48631e0f414e360964698177be5aab6a9e96ebd536d2d05f8a204efbd30175a9

.exe 214KB

48631e0f414e360964698177be5aab6a9e96ebd536d2d05f8a204efbd30175a9

IMPHASH a8169e1b002586c57d49db627d1b21bf
SHA256 48631e0f414e360964698177be5aab6a9e96ebd536d2d05f8a204efbd30175a9
MD5 b0396656a3b7968a8a8adca462e498b7
SHA1 4fa2878b80116e5fccbb5d48c580eea8eb402c2e
SHA512 f4bc845f6db4dd3ac34def5845f9e0a7b9da4f30e69ab21846ade82c21433c7b603d259e7941296e42ae67bef19f8092df4e13199b48bbe4ff6354cc7b59d917
SSDEEP 3072:SzIjT9hxqm1inJYxGcvcqBElY1Ju48kS4GC6v0J6Yzrm9jf50k:BhxqmLN0qOlP48uqR0
TLSH
T10E248D49B3A50CF8D4B78139C962465AEB7378450350EBDF07A0867AEF236D06D3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

58564

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

HeapDestroy DeleteCriticalSection GetProcessHeap HeapCreate EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection WaitForSingleObject Sleep SetEvent CloseHandle CreateEventA GetCurrentThreadId SwitchToThread SetLastError VirtualProtect InitializeCriticalSection GetSystemInfo CancelIo lstrlenW CreateEventW ResetEvent WideCharToMultiByte TryEnterCriticalSection SetWaitableTimer CreateWaitableTimerW HeapAlloc TerminateProcess ResumeThread OpenProcess OutputDebugStringW GetSystemDirectoryA GetThreadContext VirtualAllocEx CreateProcessA SetThreadContext GetExitCodeProcess GetCurrentProcess CreateFileW CancelWaitableTimer LoadLibraryW CreateThread GetLocalTime GetProcAddress GetCurrentProcessId FreeLibrary GetConsoleWindow IsDebuggerPresent SetUnhandledExceptionFilter WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetStringTypeW SetStdHandle SetEnvironmentVariableW HeapReAlloc GetLastError HeapSize InitializeCriticalSectionEx VirtualAlloc VirtualFree WriteProcessMemory HeapFree FreeEnvironmentStringsW GetEnvironmentStringsW MultiByteToWideChar GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetFileType

user32

ShowWindow TranslateMessage PeekMessageW DispatchMessageW MsgWaitForMultipleObjects wsprintfW GetInputState PostThreadMessageA

advapi32

RegSetValueExW RegOpenKeyExW RegCreateKeyW RegDeleteValueW RegQueryValueExW SystemFunction036 RegCloseKey

ws2_32

WSAIoctl closesocket gethostbyname WSACleanup send socket connect recv htons setsockopt WSAGetLastError WSAEnumNetworkEvents WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSASetLastError WSACreateEvent WSACloseEvent shutdown WSAStartup select

winmm

timeGetTime

Name

.text

Size

142KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

54KB

Virtual Size

53KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

48631e0f414e360964698177be5aab6a9e96ebd536d2d05f8a204efbd30175a9

kernel32

user32

advapi32

ws2_32

winmm

generic