🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 023120cef031fb5530d0c3c36fec36ff413583ab72f4f93dbc40208d4902e8dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 023120cef031fb5530d0c3c36fec36ff413583ab72f4f93dbc40208d4902e8dc
SHA3-384 hash: ce202f2c231d5089c39d8c3509c0bfc4c88610ff7f4805740d22426322d8f72999ae927230683adbc870193aa79d987b
SHA1 hash: b3b5f21117572a4a098a1257f3a7021c8da29413
MD5 hash: 7f4593a119d4fcbcf6025675fe7958cc
humanhash: potato-oxygen-california-cup
File name:023120cef031fb5530d0c3c36fec36ff413583ab72f4f93dbc40208d4902e8dc.exe
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:2'779'610 bytes
First seen:2026-10-28 00:13:14 UTC
Last seen:2026-10-28 00:34:10 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 88016fcdef7f227c62171d0afad9aae4 (33 x Adware.OfferCore, 32 x ValleyRAT, 23 x Tofsee)
ssdeep 49152:RuI2h3fThNn4EL3B5ogBSyun/ggS76zvJO5WImt0XDR6KG4VqYqZ:R5ONN4El5ocSX/gL7kBO5WIw0XDR6PkA
TLSH T102D5E13BF28B653EE06A1A367A72E210583B7A6165164C1296ECF48CCF751701E3F787
TrID 50.8% (.EXE) Inno Setup installer (107240/4/30)
20.4% (.EXE) InstallShield setup (43053/19/16)
19.7% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
3.0% (.EXE) Win64 Executable (generic) (6522/11/2)
2.1% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 5050d270cccc82ae (117 x Adware.Generic, 87 x OffLoader, 51 x ValleyRAT)
Reporter Tuxxin
Tags:exe ValleyRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
193
Origin country :
FR FR
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/f69dbbd7-75e2-4aa2-9207-52f646a911f7/
Malware family:
n/a
ID:
1
File name:
https://www.juorr.com/Relat%C3%B3rio.zip
Verdict:
Malicious activity
Analysis date:
2026-10-27 16:21:42 UTC
Tags:
arch-exec delphi inno installer arch-scr evasion
Link:
https://app.any.run/tasks/28c67e52-cd06-4823-b741-436697cdfcab

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/95563/
Detection(s):
SecuriteInfo.com.Gen.Trojan.Heur.FU.am0@auXRm0dj.36715624.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae13e1d49621540087bff18
Tags:
delphi obfusc shell sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-vm embarcadero_delphi evasive fingerprint fingerprint inno installer installer lolbin lolbin obfuscated wscript wscript
Link:
https://www.filescan.io/uploads/6ae13e55284524ae836f0385/reports/d20ea065-88f6-47ce-9a5f-fe31ed5cc3d4/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/023120cef031fb5530d0c3c36fec36ff413583ab72f4f93dbc40208d4902e8dc
Verdict:
Clean
File Type:
exe x32
Link:
https://opentip.kaspersky.com/023120cef031fb5530d0c3c36fec36ff413583ab72f4f93dbc40208d4902e8dc/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/ab3f9b05-83dd-4e01-a5e6-71c924a960bd
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1993601
Signature
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1993601 Sample: 8iOCzObo2N.exe Startdate: 28/10/2026 Architecture: WINDOWS Score: 60 54 mr-b01.tm-azurefd.net 2->54 56 casoneroutegold-prod-bggfgca0dkaag8a8.b01.azurefd.net 2->56 58 Suricata IDS alerts for network traffic 2->58 60 Multi AV Scanner detection for submitted file 2->60 62 Joe Sandbox ML detected suspicious sample 2->62 10 8iOCzObo2N.exe 2 2->10         started        signatures3 process4 file5 48 C:\Users\user\AppData\...\8iOCzObo2N.tmp, PE32 10->48 dropped 13 8iOCzObo2N.tmp 3 5 10->13         started        process6 file7 50 C:\Users\user\AppData\Local\...\_setup64.tmp, PE32+ 13->50 dropped 52 C:\Users\user\AppData\Local\...\_isdecmp.dll, PE32 13->52 dropped 16 cmd.exe 1 13->16         started        18 cmd.exe 13->18         started        20 cmd.exe 13->20         started        22 18 other processes 13->22 process8 process9 24 conhost.exe 16->24         started        34 3 other processes 16->34 36 4 other processes 18->36 26 tasklist.exe 20->26         started        38 2 other processes 20->38 28 tasklist.exe 22->28         started        30 conhost.exe 22->30         started        32 conhost.exe 22->32         started        40 43 other processes 22->40 process10 42 Conhost.exe 26->42         started        44 Conhost.exe 28->44         started        46 Conhost.exe 30->46         started       
Score:
78%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/023120cef031fb5530d0c3c36fec36ff413583ab72f4f93dbc40208d4902e8dc
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/7f4593a119d4fcbcf6025675fe7958cc
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/023120cef031fb5530d0c3c36fec36ff413583ab72f4f93dbc40208d4902e8dc/
Threat name:
Win32.Trojan.Qwexlafiba
Create hunting rule
Status:
Malicious
First seen:
2026-10-27 16:27:29 UTC
File Type:
PE (Exe)
Extracted files:
43
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=aiysbtxqgh5vkmgqypbw73bw75atla5lol2pspn4iaqi2sic5doa._file
Result
Malware family:
valleyrat_s2
Create hunting rule
Score:
  10/10
Tags:
family:valleyrat_s2 backdoor defense_evasion discovery execution installer persistence
Link:
https://tria.ge/reports/261028-ajelcseh89/
Behaviour
Modifies registry class
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Views/modifies file attributes
Inno Setup is an open-source installation builder for Windows applications.
Enumerates physical storage devices
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Enumerates video capture drivers
Discovers running processes
Executes a VBScript file via the Windows Script Host.
Hide Artifacts: Hidden Files and Directories
Adds Run key to start application
Enumerates connected drives
Indicator Removal: File Deletion
Looks up external IP address via web service
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Family: ValleyRat
Malware Config
C2 Extraction:
134.122.191.188:7111
134.122.191.188:7112
127.0.0.1:80
Unpacked files
SH256 hash:
023120cef031fb5530d0c3c36fec36ff413583ab72f4f93dbc40208d4902e8dc
MD5 hash:
7f4593a119d4fcbcf6025675fe7958cc
SHA1 hash:
b3b5f21117572a4a098a1257f3a7021c8da29413
Link:
https://www.unpac.me/results/f1ad2316-09e9-43ab-b11a-cff8159cf716/
SH256 hash:
5d56e8c19fba67473cbd76ac42d0d73f68276a8331f263fcd8f34de244e8611a
MD5 hash:
7e56df691af7b3509b02b9c6e9442843
SHA1 hash:
1846d7faf3c02e8942cf8eaca8f2047aefbe18bb
Link:
https://www.unpac.me/results/f1ad2316-09e9-43ab-b11a-cff8159cf716/
SH256 hash:
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
MD5 hash:
e4211d6d009757c078a9fac7ff4f03d4
SHA1 hash:
019cd56ba687d39d12d4b13991c9a42ea6ba03da
Link:
https://www.unpac.me/results/f1ad2316-09e9-43ab-b11a-cff8159cf716/
Malware family:
ValleyRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/023120cef031/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/023120cef031fb5530d0c3c36fec36ff413583ab72f4f93dbc40208d4902e8dc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:MULTI_Malware_AgentTesla_ForgeAuto_ed343f78_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects AgentTesla (inconnu, etat extrait)
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:WIN_Malware_Unknown_ForgeAuto_1708427c_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_4ab123d7_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_6422f546_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_f5d58a9e_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ValleyRAT

Executable exe 023120cef031fb5530d0c3c36fec36ff413583ab72f4f93dbc40208d4902e8dc

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/95563/

Comments