valleyrat_s2 | 5ba583585e4fe56cdee37569ffd4702d908035c8bf9b8991c69143cc7a665f63

General

Target
Financial Statistical Reports_1435.iso
Size 984KB
Sample261102-cq4vyadh77
SHA256 5ba583585e4fe56cdee37569ffd4702d908035c8bf9b8991c69143cc7a665f63
MD5 7f275c951df49d42b0ab11a73a2b6130
SHA1 061f54faa107a713c184b7322df05227ba1c7d7e
SHA512 bb450ca99dcee8a3cb226217720ab2aed2fb151bab560d4c8f1a0a0f468b399617a165e703c9c44fe76023282a65531f561db66c78348edd9ff51156ca7e12e4
SSDEEP 12288:MKTr92i/qCDrWz88MsbP0cVt0ogGVuG8FHHOrWTNEFTyEgRCzBd+fZ8OMO3J:hVyuWg8MkV+7ouBFHHXTNE1oCdd+f+p
TLSH
T14025F046F3A419F5D0ABC138C9628516E772BC9A0775CBCF33A8466A2F232D14E3D752
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

valleyrat_s2

Version

1.0

C2

47.76.170.135:443

Targets

- Target
  Financial Statistical Reports.exe
- Size 367KB
- SHA256 a150614db8802e3700db945c42f7e9c2fb03cfdcbea7854b0b072a2e35a11b77
- MD5 d455b3b0529d73929fb2f2ecd43b4f75
- SHA1 934549d96c0d836579d0ffd0d8c580ecbcd87b65
- SHA512 b490795b2bf54e1edb0d1f7075cf9c58fc7255e0ecef0ebce499ad42945700e2237421196f57880b92f7e3d036ee9b95354c9157d3f3b3a9a7fd65ff7d9c0952
- SSDEEP 6144:UK0CMcoPY19CebAiwu6B36NDrd8zzJ6aFMMkxGbP0cw:UKTr92i/qCDrWz88MsbP0cw
- TLSH
  T1EC849D46F7A418F5E0A7C139C9628906E7727C9A0770CBCF23A4466B2F272E15D3D762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence privilege_escalation ransomware
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  VSPMsg.dll
- Size 9KB
- SHA256 20fed915cd893469f7b5d74b0f9d1e845b62bfbb4fdf93a8434269e87a193f10
- MD5 c086f13c6381d7016a7f51d383eaf70b
- SHA1 1831e420e6d64c669cd484fdf5efd04b4bcd74a8
- SHA512 3715f05cec8cacfdb36ad2afbd939e7ca195b090c7dd24568e9d87bca020ee42973171c13a6917aaad112f723ce455987833918618cb67d1b2b9afd1eb2dd878
- SSDEEP 192:5LjzBNDets1OmDZk8Vc+eqyf7H2M/wWZJcYXHrlnT+Qgeol:pvyq1Vdk8eqc6M/wW0yrRCQ2l
- TLSH
  T18512FA02F7E031FCD87AC27407976123E6B1BC499932E71FAB8257623870651EA39769
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor defense_evasion discovery execution valleyrat_s2 persistence privilege_escalation ransomware
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4