valleyrat_s2 | 720b8e3f4ffdab751c263dd69e2459375a5373e8e79e2637ce46d4b5ac21e361

Sharing

Copy URL Twitter E-mail

General

Target
02112026_0247_30102026_image_8YFAKDKCB26R.img.zip
Size 1.6MB
Sample261102-c95xcagy3n
SHA256 720b8e3f4ffdab751c263dd69e2459375a5373e8e79e2637ce46d4b5ac21e361
MD5 2346c4bd9c6e96f8f0f973c19208657c
SHA1 f077e50df0df9adb61603425d3faae3a8cde28f3
SHA512 4e67bac2f7df3c46145a540c78841f6a579decb018f45a273b02299904a41307182b3baf5a1e7bde45e6be1d73b5847ea35c04ebcd0890eb74120067b1a3536c
SSDEEP 49152:bsf/9YQfqafdRKqiD4GgbkB+QY73db758Kp7/+Q:bq1YQfqaVc/MDbkhY73B7J/D
TLSH
T10575332B4961C0DBEA50A9F21C39E6CD38B58B34E45F473E1E0F5BBE0906F676293542
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

valleyrat_s2

Version

186.241.116.38:22135

Targets

- Target
  FileReportEx.dll
- Size 1.9MB
- SHA256 e2101b06f722336ac970ebc629da7bcde7d3c7e91e660d0ba2754fa041d877dc
- MD5 52cc9d6ced651b4e899a5a70feedff47
- SHA1 909ede6cc1779f5ddc02d76c1c2530b53c06d4a1
- SHA512 1ebca2cc72b2cc546362a2a121d92fc86adc5c5cd2b69aa5c6d638851d3e4cf242296722eef7ff0f6fe7537cab4167a7208235eedf07a49930cc91f1071e2691
- SSDEEP 24576:6qL52lNeP+JS/zVmKitKk4U8YIklXWurdf6/K9P:Z2lNePqS/guK9P
- TLSH
  T151957DA03781A7EDE9A4A5FD8A07EB8923FAAD137F0160A5FB0E4B811737C525C07547
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  R8HQO.exe
- Size 439KB
- SHA256 c09d9caef509f0f6001f1d3e3bb7f71d57aa77b7bfa751e198fe12c317cb77f2
- MD5 f5f7037c332180929a8bb0dad231a4db
- SHA1 1b4cf6142b30645385daff016203e32849507d66
- SHA512 a0a5a6f983071aa297b6a6ee818499863b90135b3463ef2056d9c07af1eec2338585accd56e5c2c00de8427a1259c6b0881752c2c06fa2b9daffdf8f3e10101c
- SSDEEP 6144:OzAqL3E52ZoIWPG833BJqYNqN4O6jWMNvkLRrkU6qk+qM8n5dCKqoYXd:/UWG8HBJqYNqCO6jbOLTfDo5dCKy
- TLSH
  T13CA44A5AF62801ECC16B927C9AA79D43F7B1784D47618ACF13D097362F236E16E3E211
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery valleyrat_s2 persistence trojan upx
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- UAC bypass
  defense_evasion trojan
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral3 behavioral4
- Target
  liblz4.dll
- Size 121KB
- SHA256 06c6aac092ebc16c6580676a5696186ee1f3d30960c085ff95b2724fec5f8451
- MD5 2f264ae520c8b4c678cbee9cdb13d222
- SHA1 e5a5d6ad0a6ad6ef5b37973668c61c9b21570643
- SHA512 d14d5d636a81f35c0245cc7c080b3a4cecde38168620fb21a0954bb9b691780f43e9257acf68680006abbc9c52be508b1b3cf5d13bed9f53c843f2b7a088af2c
- SSDEEP 3072:RQwOzZKErLfd7xAOGVePvSjZ0370aVEN3AQN0:Rj6ZKErzd7xjGVeXAZ03z2
- TLSH
  T1D2C36B83F6E512BDD162D1BD9AA68217E67579188300EBE787D8CE716F23E900E32315
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  msvcp140.dll
- Size 553KB
- SHA256 3048df1cf8d476e998dde28ed6b67856b47ec5ae2b2c221fb1733f43c550c701
- MD5 e3791c5b54bd3f1d2a61b1beff9ef5f2
- SHA1 f55535eff838a93bcab300673e93447c3d0a54ef
- SHA512 14931c8e05484989bdbea942f797b0e3d1ef6fb1e60a47b30f3f84b56adc35e18a3c7943004f75e96fbf1a2d5df0452b2511a18418705b3c84c57f2d11b11c04
- SSDEEP 12288:0Tv2OuTt6DRh4l0PU+tDLjfhQEKZm+jWodEEVT6um:0FU+1hQEKZm+jWodEExZm
- TLSH
  T186C41923B75905A0E195E3B891838705D7F07C4A8322A3C792FBD5AE2F5B7D1A73B250
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  msvcp140_1.dll
- Size 25KB
- SHA256 086e083da4e7a46438aff3188beb2c0d14cb38af216c62a880cd8209dfcfcca8
- MD5 6e10c7dff6c6f55ba43c784037958341
- SHA1 82afedb28493bff8ba462d0bb012fdc35d25984e
- SHA512 6135353999206fc1f8b9bc52fa2383ef86d999a0d903c2806a3f621cc68c34241ace70c8c86f6589dc41d84ace5d79ca46f8ba83334434826088dc4d29bfc8de
- SSDEEP 384:mDN8AFcc1nOx9dq/1Wc15gWWCr2VHRN7dFDtdQ5R9zrjdb:mZPFccIxPq/TJOdDds9zvJ
- TLSH
  T196B25B86EB14C846ED564830C99ADE436A39B7D41B50A7CF1395BA1C0DE33C2FE35A2D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  msvcp140_2.dll
- Size 252KB
- SHA256 5fd1bf62b065bd9a8bcbf8552d9ffd24f96341c10a4b93c5be0282a2f704fb2e
- MD5 15c26b825ab7dcd52472746fa0f3cb1f
- SHA1 7ad10975109e2003b1d7ea10cd98a22cde8b8dfe
- SHA512 6b2fb0a880b28e3fb939280dab52a5a6679b5dc603c9c80457840eb81c451124b5617a4571d6ede034f6332b2b11c2b65ad62287edbec739baf83a12ad83dc6d
- SSDEEP 3072:tlNIQs3d7QsQIPxv+evBCiuxLQtDVbqyFjOqGUSHNKtdjhESjUJ2aRAAuO1UL9ZT:tzPnIPB+W9FjOq9CcrjhKJ36ve5vWY8R
- TLSH
  T1FA440716B5092FBFC8E6A4B04939B412FC2A36405731C48A16C32D4DAF1FA577EE356E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  msvcp140_atomic_wait.dll
- Size 39KB
- SHA256 d4fdd222f3f2880651edf6802bc44710a3d66c691c3afb7fe2bf3229f06ff935
- MD5 32920dc27d6663b544fa57760642ba7a
- SHA1 b819a651e97d2e07da580e7cfa468201b9304a61
- SHA512 083ad5a8db0511a9ab386342658e0b5197edcb873fd8db8f6aaa87806da8091ba980dde843eb378c201d873dab75ca1f6be47bb3607ea12d949b0f6492717bd9
- SSDEEP 768:DrulGoz1ViLdOfv+rpABXeGHasDFvR7in9zt/:qGeiaKiBXeGHasBo9zt/
- TLSH
  T1AE036C5E63A44482E46746348062A62BE7BB76E24B10D7DF5721F09E0F637D0FB34B1A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  msvcp140_codecvt_ids.dll
- Size 21KB
- SHA256 109312ce9e35c66c8f411d1fc74aba902c46cd65ca40883d2eb779fb09031c33
- MD5 03243cab6858eae7faa4425c1d3e02ac
- SHA1 98c8d460ffb2d676e6ba6d7116f0b1512bcd605c
- SHA512 63e41f7193f185832304e47b42764d73c82833c327d2c3bf73fb06b3905591328da036b3746439a63582742b39ff40c7a94a4408068381e784203d8b04d3cae0
- SSDEEP 384:Z4DgP2fsle6WirEWVr2VHRN7DkELRPR9zywhFn:sgPw/onOQQ9zV
- TLSH
  T13DA26D86E6284547ECAA4870C1BECE477C7D77921A20938B13A1F0191DA33C7EB3566D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  vccorlib140.dll
- Size 336KB
- SHA256 430accf44c39446446cf541174ad4fa4e8a25e603c389a524caf8de1606e45be
- MD5 522eff8c1303dee8bd8eb385a0c20e9b
- SHA1 5957f5d1a8509c772c15eb6de268d9b52f66dbee
- SHA512 023651994cd23a722af0c81bdc3269f6de6a16174b5ab13f447b9d248e85e008eaa19899f5023dbd65933263e671aa00477d15dbaaf47d85201fef99b942f68b
- SSDEEP 6144:aep8WHdoHDGzBb/Cpx+/hBgyzgMXxUc0J3etWGx0CttwV2eo+lLXuF560XA2eUSL:VtmJO3GgtWp1qVXAfF6mJ19Mq
- TLSH
  T18574C56B2A9C0CD3CD3160760E979309E3B278510B61A7CF1691470F5E3FBE4AE7A664
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  vcruntime140.dll
- Size 108KB
- SHA256 9593801b89cf3c0a46056f4d923d67b5c685fb8760f007b4d194e4a6a6ed9396
- MD5 41e66b1c590019dc99f544513c0693bc
- SHA1 d882329c786bd1038bbeeecc58c2f3b2a085ac22
- SHA512 8296f7e4113d4e6dbee72a7d29358a67b4ffd1e284a01a3b7fbf4e85878a07444777df6d3c2e6efdea7e7d7a1f167d7fad755f78a655cdb2b89d0330265ed611
- SSDEEP 1536:gQOierMULrYaTw+xkU4X3X6pjxP9vPOiDxvkcYYbBD4ZecbuHcTa3xzZY:g/trT2XH6POiDxMcYoKZecbuHcTUxtY
- TLSH
  T193B36B8A72A003F7D16AC239C1A32A16F771F8548760A7CF03A54A7A1F53BE15E3D356
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  vcruntime140_1.dll
- Size 38KB
- SHA256 b49a9b9c334e66bb14e0bd784be2e0a86edc7d24a9ebf90d1b2bbd71451695c9
- MD5 15e66163e8bdaaaf8bb775b29d9f98b0
- SHA1 48a854b69efa1ab9ef2ebae9b465e4b8ea415ffb
- SHA512 e9f3cd24957045ecd2fe9e175de2909474ce9c69b2c81e4575e965ab4e7b34d7ea7eef3071079b0a176ed67ca2324423b57189713b8d9312804f24dabf1a4ca8
- SSDEEP 384:QHbrv6WeyJSGeWuh1fD/Hk+GlbjWyIhHz6Yf2Q1mPOw6U8z3WrfKWdtT7nHRN76L:zWeMk/D/HunfmHz6SC8MD1Q9zVp
- TLSH
  T14E034B9467B84086E0AF91B4C4D76F17BA7CF9650B50938F0BA1919C2F637D0AB3E316
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  vcruntime140_threads.dll
- Size 27KB
- SHA256 2f2709047b2e0ec13e4e344f0a044453880fb179522f995d848589ad5e31637f
- MD5 197eeb94fec5cd4e82a04005dcf2fe47
- SHA1 d7dd929f853f1edabc8680c91abf38b6eeb6a197
- SHA512 a8df4e656012240572b4de241a285ae9d2a09f135d8b51b104faa00fb50f2480c7178e158e6a1f38705c61ecbd39dbcd6edaf35734fdc0a1d7d78109baf5ebfd
- SSDEEP 384:LD5EQ+DbxF4y+LMVHWzj27Z9gf3moarJcpWrj+W6r2VHRN7EoJR9zRF:LD5EQoVHOj263mo0paOz9zP
- TLSH
  T123C28E86AB6484D6D5EB4470C5BAD947ED79FA920B1082CF03C0FA890E773C2E93971D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24