Malicious
83a191c82a700bd83128f7ad8576a1cd
PE Executable
MD5: 83a191c82a700bd83128f7ad8576a1cd
Size: 346.11 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
346.11 KB · 346,112 B
Hashes
MD5
83a191c82a700bd83128f7ad8576a1cd
Sha1
5cdbcbbd73e6c239fd73ee8597e0e57d7c4182f5
Sha256
3e6b5327d9d19cdcd8adf389b991cba090c49bd9f11d4909da89e19420c16b42
Sha384
a22e760d84d9396dc324786ea1a8d3455038c840db81dc296004722ee856e841da116ab6ec35636569353164f574c2d4
Sha512
17e301cf9ac5d90bf3da61a9fc91b71eeeaac93bd057dfe01c37c1fe46134f1eb93d603ca4062d313dc887d8cef7803e6e5f406442d1772eaf6b9e4db27d1223
SSDeep
6144:Wn+06yirywPV6q6KRIb1qkNMJ5A8S0+z2oQHUeFMr:mh6yiBP3DkK5A8S0+2oIU
TLSH
19747C21B291C236D5AE1134A679DB7B0D7D78310BE5D0CBA3D04A6E1E213E2EF3475A
Detection
PeID
MS Visual C++ v7.0 DLLMicrosoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamVisual C++ 2003 DLL -> MicrosoftVisual C++ 2005 DLL -> Microsoft
1 malicious · 1 file
EXE83a191c82a700bd83128f7ad8576a1cdValleyRat
Structure
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
pe:dll
Shape
pe:dll
1 nodes
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | t_no_ahuhuhuhuhuhuhuhuhuhuhu |
| UserAgent | _CB&pthuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | cal_tkhuhuhuhuhuhuhuhuhuhuhu |
| UserAgent | /commohuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | t_3rd_huhuhuhuhuhuhuhuhuhuhu |
| UserAgent | r�o�g�huhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | ogin2.huhuhuhuhuhuhuhuhuhuhu |
| UserAgent | ^1Y%?�huhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
1 malicious · 1 file
EXE83a191c82a700bd83128f7ad8576a1cdValleyRat
Structure
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | t_no_ahuhuhuhuhuhuhuhuhuhuhu |
| UserAgent | _CB&pthuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | cal_tkhuhuhuhuhuhuhuhuhuhuhu |
| UserAgent | /commohuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | t_3rd_huhuhuhuhuhuhuhuhuhuhu |
| UserAgent | r�o�g�huhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | ogin2.huhuhuhuhuhuhuhuhuhuhu |
| UserAgent | ^1Y%?�huhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
You must be signed in to view YARA rules.