ValleyRat PE Executable malware analysis – f37e7d37a118

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

File

Type

Portable Executable file

Detection

PeID

Microsoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ v6.0 DLL

2 malicious · 4 files

EXEf37e7d37a118f1b76dc56fedf4f2820cValleyRat

Structure

BINOverlay_494e53c2.bin

EXE[Rebuild from dump]_7e1147ba.exeValleyRat

Structure

BINResources

STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 3 STICH kept: 1secondary ignored: 2

bin 2

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.

Path pe:exe>pe:exe

Shape pe:exe>pe:exe

2 nodes

Name	Value
Info	Overlay extracted: Overlay_494e53c2.bin (28160 bytes)

PE Layout UNKNWOWNsuspect

Memoryhuhuhuhuhuhuhuhuhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential