🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01c204a2a9f0989e3abee0f237f6080f2f072467a4d83dd4a4921443a60d09fe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 01c204a2a9f0989e3abee0f237f6080f2f072467a4d83dd4a4921443a60d09fe
SHA3-384 hash: c3debd77fad1a12679962758db81930c9f95eeeabd2d2785935f45c2ab016111891cdfeabce9f124bbe6f88380459510
SHA1 hash: 12c03ebc0cc96cf77e0e6643757812471a7761f4
MD5 hash: 7e30b3afd8cbcbc84c82b2a88c2ce1e6
humanhash: edward-friend-zebra-eleven
File name:LetsVPN.zip
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:53'054'380 bytes
First seen:2026-10-24 07:35:08 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 1572864:A7FtwDDpn3W1zvjdF79GhMsmtEHm72+VvSMBdX:Aj0mBEhMttEHm7xwMn
TLSH T1EFC73397B5BAE76C1151656FC20D83C82EA2B01DFC6F7D38D658BC486238293646CD8F
Magika zip
Reporter smica83
Tags:ValleyRAT zip

Intelligence

File Origin
# of uploads :
1
# of downloads :
117
Origin country :
HU HU
File Archive Information

This file archive contains 1 file(s), sorted by their relevance:

File name:ysds_win11_desktop_10.22_scjsk.exe
File size:53'377'019 bytes
SHA256 hash: 11d2f0cfe606b118003a442d865a9ae83d3fd889948868ac90850b3d09961f3e
MD5 hash: f79f6d40474123e9b5b0a97a45885cc5
MIME type:application/x-dosexec
Signature ValleyRAT
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/f82813f3-4ba2-4506-8390-09a990ce3130/
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6adc5fcd5a22ac805bd9edc4
Tags:
bagle nsis
Result
Verdict:
Malicious
File Type:
PE File
Link:
https://app.docguard.net/01c204a2a9f0989e3abee0f237f6080f2f072467a4d83dd4a4921443a60d09fe/results/dashboard
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
active-directory adaptive-context anti-debug anti-vm anti-vm base64 CAB crypto evasive evasive expand expired-cert explorer explorer fingerprint fingerprint greyware installer installer keylogger large-file lolbin lolbin nsis packed ramnit reconnaissance reconnaissance regedit regedit regsvr32 rundll32
Link:
https://www.filescan.io/uploads/6adc5fc10402cb0dc14e7794/reports/cbcda923-2df5-4647-9183-eee9dcba8893/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/01c204a2a9f0989e3abee0f237f6080f2f072467a4d83dd4a4921443a60d09fe
Verdict:
Malicious
File Type:
zip
First seen:
2026-10-24T05:45:00Z UTC
Last seen:
2026-10-24T06:06:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/01c204a2a9f0989e3abee0f237f6080f2f072467a4d83dd4a4921443a60d09fe/results?tab=lookup
Score:
53%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/01c204a2a9f0989e3abee0f237f6080f2f072467a4d83dd4a4921443a60d09fe
Gathering data
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-23 04:48:30 UTC
File Type:
Binary (Archive)
Extracted files:
12
AV detection:
5 of 36 (13.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ahbajivj6cmj4ov64dzdp5qib4xqojdhutmd3vfesikehjqnbh7a._file
Result
Malware family:
valleyrat_s2
Create hunting rule
Score:
  10/10
Tags:
family:valleyrat_s2 backdoor bootkit defense_evasion discovery execution persistence
Link:
https://tria.ge/reports/261024-j4jv9aaw6l/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Direct Volume Access: Opens a physical disk for reading
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Checks installed software on the system
Writes to the Master Boot Record (MBR)
Executes dropped EXE
Loads dropped DLL
Family: ValleyRat
Malware Config
C2 Extraction:
137.220.140.19:15443
137.220.140.19:5555
137.220.140.19:8888
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:SUSP_ZIP_Smuggling_Jun01
Create hunting rule
Author:delivr.to
Description:ZIP archives with data smuggled between last file record and the central directory.
Reference:https://github.com/Octoberfest7/zip_smuggling/
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:Win_Clipboard_Clipper_Thengavar
Create hunting rule
Author:Thengavar
Description:Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments