valleyrat_s2 | 1317188d155e6c61df4b29b7ea6e2c86fbd5bd8fb5301a4f92f708ae4f93519b

General

Target
1317188d155e6c61df4b29b7ea6e2c86fbd5bd8fb5301a4f92f708ae4f93519b
Size 588KB
Sample261102-cxt93set8v
SHA256 1317188d155e6c61df4b29b7ea6e2c86fbd5bd8fb5301a4f92f708ae4f93519b
MD5 456b4df0a20e95b9a0b611a0c5a762a1
SHA1 2dc4f318c4db4c53245df01af6d3be12f8f62a36
SHA512 c95a2969d0de694cdfb7b4fb276bd421b9a2a4e92b2efdd736953aeb270773cba70d92e6247d2dde72ce59d18aa65085fe506eba9ee43e6569b5e714edc21bad
SSDEEP 12288:1p8ltKEIijyp8sdeg/fN5uRjmRSuCM3aQPBzSvxZ0F5a8wNl:1p8vKEIijy+i//fNYRmwELZ95sNl
TLSH
T154D4339C218ABBD9F2E0E7B796FC60E14794E17F2C37B56A2F989756480BC7504EC084
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

valleyrat_s2

Version

1.0

C2

45.142.152.45:6666
45.142.152.45:8888
45.142.152.45:80

Attributes

campaign_date
2026.10.30

Extracted

Family

valleyrat_s2

C2

45.142.152.45:80
45.142.152.45:6666

Targets

- Target
  2026.11.02裁员名单及补偿方案WPS.exe
- Size 585KB
- SHA256 2d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d
- MD5 315bda377beafb746f1c2f4fba430867
- SHA1 62e3ba37a23669139a222cd43ec2b202277a4030
- SHA512 dbf0dfd5e062c1869a20876013cb30c6e6a563c4e46027396c0590ad93d1c3fef5b42a0f68a82c20db90cfd5cfc4d3fae0452c784f0d40c63049d0c7a3d26018
- SSDEEP 6144:vMTDKZGfvKRhPTyB0fVL3A8AG1myJ0bLehmzQnZoMTroJRoKhiz3ZZs+PE7b39By:wDKZGMsqsN9MpxJsse796CvbFJTG
- TLSH
  T1B3D45A9ABB6887F5D02BE17984D68242E3B574520B2197CB02B12B6D1F377E25D3F321
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor discovery valleyrat_s2
- Detects ValleyRAT payload
- Family: ValleyRat
  ValleyRat stage2 is a backdoor written in C++.
  backdoor valleyrat_s2
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  teamspeak_control.dll
- Size 135KB
- SHA256 52fbd5166412c41e6580dc149712492f1eb0ed561650b7fabc326014f9c3057a
- MD5 319836c99f2187f6057c1e0ec6008101
- SHA1 1f13956a99144360b4a8928a67e3c9ba96bf67f2
- SHA512 cc98c706bf624de5675d8096cf8e6d6262400ce06e3b741963be0138fd3171cac64b02724198d6056eea6cc9e93078160c37df39718a99ae721ff8dbcba73c28
- SSDEEP 3072:g/l/KTPtHM1yyI4+ojUgmesRDqd68tnFGy:e/KT1HM8yuoAgmg0cFv
- TLSH
  T1AAD37C1777A501BBE4B79238C8530646E773B8150A709B6F03B4469A2F273999E3EB31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4