ValleyRat malware

File types

• PE Executable27

Recurring C2 endpoints

• hxxps://ssl[.]xui[.]ptlogin2[.]weiyun[.]com/cgi-bin/xlogin?appid=527020901&daid=372&low_login=0&qlogin_auto_login=1&s_url=hxxps://www[.]weiyun[.]com/web/callback/common_qq_login_ok[.]html?login_succ&style=20&hide_title=1&target=self&link_target=blank&hide_close_icon=1&p2
• hxxps://www[.]weiyun[.]com/web/callback/common_qq_login_ok[.]html?login_succ&style=20&hide_title=1&target=self&link_target=blank&hide_close_icon=1&pt_no_auth=1Microsoft Internet ExplorerGETpt_local_token=;/pt_get_uins?callback=ptui_getuins_CB&r=0[.]&pt_lo2
• hxxps://ssl[.]xui[.]ptlogin2[.]weiyun[.]com/account/pt_get_st?clientuin=&callback=ptui_getst_CB&pt_local_tk=clientkey=/jump?clientuin=&clientkey=&keyindex=9&u1=hxxps://www[.]weiyun[.]com/web/callback/common_qq_login_ok[.]html?login_succ&pt_local_tk=&p2
• hxxps://www[.]weiyun[.]com/web/callback/common_qq_login_ok[.]html?login_succ&pt_local_tk=&pt_3rd_aid=0&ptopt=1&style=40ptlogin2[.]qq[.]comReferer: hxxps://ptlogin2[.]qq[.]com/ check_sig?'/check_sig?skey=ssl[.]ptl2
• hxxps://ifconfig[.]me/iphxxps://api[.]ipify[.]orgkernel32[.]dll%dGroupName client[.]groupClientConsolePublicWanIpLoginModule ????REMARKAppEvent2

Defanged. Extracted statically from the configurations of public samples.