MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0bab062af7894bc44d68ebc5b9633a84ffaae1f17671ff3949002c43321ec86a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 14


Intelligence 14 IOCs 1 YARA 25 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0bab062af7894bc44d68ebc5b9633a84ffaae1f17671ff3949002c43321ec86a
SHA3-384 hash: 6449c187edeb296afd5b162b6aa50bf71b857167171ae915ece3756db3f4509163ee1425de7af8bbff7d4e35c80a9cf3
SHA1 hash: 7be1989c25579401ac8638a889a1657d5182f7b8
MD5 hash: 846f4ed47a679e24505470f61d9110db
humanhash: louisiana-kansas-mars-oscar
File name:846F4ED47A679E24505470F61D9110DB.exe
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:1'873'920 bytes
First seen:2026-08-28 04:10:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 59010c5840153cfa420aabe5bb8fa447 (2 x ValleyRAT)
ssdeep 24576:K21Ymflm4a6Ts6eIsJeNhaodobEz0IsJeNhaodobEqgVl14y:K0eIsJ63+bEz0IsJ63+bEq8
TLSH T170857D01B7A89DF6F8021E3890CB67265E35BC2627124AD79B61BB125A333D19F37707
TrID 38.2% (.EXE) Win64 Executable (generic) (6522/11/2)
26.4% (.EXE) Win32 Executable (generic) (4504/4/1)
11.8% (.EXE) OS/2 Executable (generic) (2029/13)
11.7% (.EXE) Generic Win/DOS Executable (2002/3)
11.7% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
dhash icon 4959515c796d5f5b (1 x ValleyRAT)
Reporter abuse_ch
Tags:exe RAT ValleyRAT


Avatar
abuse_ch
ValleyRAT C2:
45.194.37.221:18808

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
45.194.37.221:18808 https://threatfox.abuse.ch/ioc/1743174/

Intelligence

File Origin
# of uploads :
1
# of downloads :
212
Origin country :
NL NL
Vendor Threat Intelligence
Malware configuration found for:
ValleyFall
Details
Link:
https://research.acce.ciphertechsolutions.com/results/0fcaa634-f3e4-41c2-b57b-dd772df877a8/
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-08-28 04:18:03 UTC
Tags:
payload processkiller loader backdoor silverfox valleyrat rat winos
Link:
https://app.any.run/tasks/4097fd5c-532c-4b84-a497-544417d10c1f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/83119/
Detection(s):
SecuriteInfo.com.Malware.PDB-843.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Creating a process from a recently created file
Creating a process with a hidden window
Connection attempt
Sending an HTTP GET request
Running batch commands
Launching a process
Сreating synchronization primitives
Creating a window
Connection attempt to an infection source
Sending a TCP request to an infection source
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug cmd crypto expired-cert loader lolbin mingw overlay
Link:
https://www.filescan.io/uploads/6a910a2ec0bb354ec805acf6/reports/b5e34446-d740-4cb8-b4eb-e2f12e6e0fdd/overview
Verdict:
Malicious
Labled as:
Draftor.Generic
Link:
https://www.hybrid-analysis.com/sample/0bab062af7894bc44d68ebc5b9633a84ffaae1f17671ff3949002c43321ec86a
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-08-25T10:28:00Z UTC
Last seen:
2026-08-29T20:03:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/0bab062af7894bc44d68ebc5b9633a84ffaae1f17671ff3949002c43321ec86a/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/af87cdd0-e67d-476f-892c-4b57870e185f
Result
Threat name:
ValleyRAT
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1965085
Signature
Allocates memory in foreign processes
Antivirus detection for dropped file
Antivirus detection for URL or domain
C2 URLs / IPs found in malware configuration
Connects to many ports of the same IP (likely port scanning)
Contains functionality to detect sleep reduction / modifications
Contains functionality to inject code into remote processes
Document exploit detected (process start blacklist hit)
Drops PE files to the user root directory
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Self deletion via cmd or bat file
Sigma detected: Suspicious Ping/Del Command Combination
Suricata IDS alerts for network traffic
Tries to delay execution (extensive OutputDebugStringW loop)
Unusual module load detection (module proxying)
Uses known network protocols on non-standard ports
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Writes to foreign memory regions
Yara detected UAC Bypass using CMSTP
Yara detected ValleyRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1965085 Sample: pII18imSu4.exe Startdate: 28/08/2026 Architecture: WINDOWS Score: 100 49 Suricata IDS alerts for network traffic 2->49 51 Found malware configuration 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 10 other signatures 2->55 8 pII18imSu4.exe 10 2->8         started        process3 dnsIp4 43 193.42.24.214, 16790, 49753 CLOUDIE-AS-APCloudieLimitedHK Hong Kong SAR China 8->43 35 C:\Users\user\AppData\Local\...\z7764.exe, PE32 8->35 dropped 37 C:\Users\user\AppData\Local\...\wwlib.dll, PE32 8->37 dropped 39 C:\Users\user\AppData\Local\...\WINWORD.exe, PE32 8->39 dropped 41 C:\Users\Public\DWIN, PE32 8->41 dropped 61 Self deletion via cmd or bat file 8->61 63 Drops PE files to the user root directory 8->63 65 Contains functionality to detect sleep reduction / modifications 8->65 13 WINWORD.exe 2 8->13         started        17 cmd.exe 1 8->17         started        file5 signatures6 process7 dnsIp8 47 45.194.37.221, 18808, 18809, 49752 ANTBOX1-AS-APAntboxNetworksLimitedHK Hong Kong SAR China 13->47 67 Contains functionality to inject code into remote processes 13->67 69 Writes to foreign memory regions 13->69 71 Allocates memory in foreign processes 13->71 73 Document exploit detected (process start blacklist hit) 13->73 19 tracerpt.exe 8 2 13->19         started        22 WerFault.exe 22 16 13->22         started        75 Uses ping.exe to sleep 17->75 77 Uses ping.exe to check the status of other devices and networks 17->77 24 PING.EXE 1 17->24         started        27 conhost.exe 17->27         started        29 z7764.exe 17->29         started        31 PING.EXE 1 17->31         started        signatures9 process10 dnsIp11 57 Tries to delay execution (extensive OutputDebugStringW loop) 19->57 59 Unusual module load detection (module proxying) 19->59 33 conhost.exe 19->33         started        45 127.0.0.1 unknown unknown 24->45 signatures12 process13
Score:
47%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/0bab062af7894bc44d68ebc5b9633a84ffaae1f17671ff3949002c43321ec86a
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0bab062af7894bc44d68ebc5b9633a84ffaae1f17671ff3949002c43321ec86a/
Threat name:
Win32.Trojan.Ravartar
Create hunting rule
Status:
Malicious
First seen:
2026-08-25 12:02:00 UTC
File Type:
PE (Exe)
Extracted files:
470
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bovqmkxxrff4itli5pc3syz2qt72vyprozy76okjaawegmq6zbva._file
Result
Malware family:
valleyrat_s2
Create hunting rule
Score:
  10/10
Tags:
family:valleyrat_s2 backdoor discovery execution
Link:
https://tria.ge/reports/260828-erjx9ssxe1/
Behaviour
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Executes a command shell one-liner
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Suspicious use of SetThreadContext
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Downloads MZ/PE file
Family: ValleyRat
Malware Config
C2 Extraction:
45.194.37.221:18808
45.194.37.221:18809
45.194.37.221:8888
Unpacked files
SH256 hash:
0bab062af7894bc44d68ebc5b9633a84ffaae1f17671ff3949002c43321ec86a
MD5 hash:
846f4ed47a679e24505470f61d9110db
SHA1 hash:
7be1989c25579401ac8638a889a1657d5182f7b8
Link:
https://www.unpac.me/results/4cf0d360-c5e5-461f-bbd3-52079419954e/
SH256 hash:
7eb1e3e5a6b8d68afb484b74de26c2c2de94e364335f80a4740a97dfd2644a16
MD5 hash:
9e2c0191a2e98a0414fdef3f7fd0c4d1
SHA1 hash:
6349e9371f74a1d9566b2926ef6f13a6bf1a776d
Link:
https://www.unpac.me/results/4cf0d360-c5e5-461f-bbd3-52079419954e/
Malware family:
ValleyRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0bab062af789/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0bab062af7894bc44d68ebc5b9633a84ffaae1f17671ff3949002c43321ec86a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:Gh0stKCP
Create hunting rule
Author:Netresec
Description:Detects HP-Socket ARQ and KCP implementations, which are used in Gh0stKCP. Forked from @stvemillertime's KCP catchall rule.
Reference:https://netresec.com/?b=259a5af
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:ICMLuaUtil_UACMe_M41
Create hunting rule
Author:Marius 'f0wL' Genheimer <hello@dissectingmalwa.re>
Description:A Yara rule for UACMe Method 41 -> ICMLuaUtil Elevated COM interface
Reference:https://github.com/hfiref0x/UACME
Rule name:INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM
Create hunting rule
Author:ditekSHen
Description:Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:WinosStager
Create hunting rule
Author:YungBinary
Description:https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/83119/

Comments