MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d4755125431b2df6a5232950b6c475bb6ae459a35503d64a6bc2c8075f5e2e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 18 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0d4755125431b2df6a5232950b6c475bb6ae459a35503d64a6bc2c8075f5e2e5
SHA3-384 hash: 7aa810b8c34158910ff3cb7c4ef371eba5ff0060683afd333772561593f524bc0f0c1586bf0a1287aea9702fcaf32e84
SHA1 hash: 6790e1cbf6798382504915d09bbf8b5aacc10dfe
MD5 hash: 858d6d91e6d04cb26acb51fcb516f9c1
humanhash: angel-two-xray-delaware
File name:Drv_ceo_12.8.1_x64.exe
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:15'318'651 bytes
First seen:2026-08-08 15:54:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 57e98d9a5a72c8d7ad8fb7a6a58b3daf (66 x GuLoader, 20 x AZORult, 15 x RemcosRAT)
ssdeep 393216:xxVCkFeObsJGHu9zwkXiJlrWqMudtVzBNdzV3:xxV7FtluRXFxudrzlR
TLSH T1C2F6334225E634E7F273A3B47C7BA9386A13CC359AA707A00384F5E5BC5574528B72CB
TrID 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.5% (.EXE) Win64 Executable (generic) (6522/11/2)
8.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon c4ccb392f1f192cc (4 x LummaStealer, 4 x ValleyRAT, 2 x AsyncRAT)
Reporter Ling
Tags:exe SilverFox ValleyRAT


Avatar
CNGaoLing
SilverFox
IOC (IP 202.79.174.94:8853)

Intelligence

File Origin
# of uploads :
1
# of downloads :
151
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
NSIS
Details
Link:
https://research.acce.ciphertechsolutions.com/results/9f7ed745-8f60-4d8a-9d30-42ee181bebad/
Malware family:
n/a
ID:
1
File name:
Drv_ceo_12.8.1_x64.exe
Verdict:
Malicious activity
Analysis date:
2026-08-08 15:22:58 UTC
Tags:
rat valleyrat winos donutloader loader
Link:
https://app.any.run/tasks/1af00111-7221-4417-832c-92e43cf33a99

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/79244/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% directory
Creating a file
Running batch commands
Creating a process with a hidden window
Launching a process
Using the Windows Management Instrumentation requests
Searching for synchronization primitives
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Deleting a recently created file
Creating a process from a recently created file
Launching a service
Creating a file in the Windows subdirectories
Creating a file in the Program Files subdirectories
Creating a window
Creating a file in the %AppData% directory
Connection attempt
Sending a custom TCP request
Adding an exclusion to Microsoft Defender
Enabling autorun by creating a file
Verdict:
Malicious
Labled as:
Malware_
Link:
https://www.hybrid-analysis.com/sample/0d4755125431b2df6a5232950b6c475bb6ae459a35503d64a6bc2c8075f5e2e5
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-08-08T12:26:00Z UTC
Last seen:
2026-08-10T11:08:00Z UTC
Hits:
~10
Detections:
HackTool.Multi.AmsiETWPatch.sb Trojan.Win32.Zenpak.sb Trojan.Win32.Shellcode.sb HEUR:Trojan.Win32.Shellcode.gen Trojan-Downloader.Agent.TCP.C&C PDM:Trojan.Win32.Generic PDM:Exploit.Win32.Generic HEUR:Trojan.PowerShell.Starter.gen
Link:
https://opentip.kaspersky.com/0d4755125431b2df6a5232950b6c475bb6ae459a35503d64a6bc2c8075f5e2e5/results?tab=lookup
Malware family:
Donut Injector
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/0b2f16e8-4726-4c73-9646-57b4f2668cdc
Score:
87%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0d4755125431b2df6a5232950b6c475bb6ae459a35503d64a6bc2c8075f5e2e5
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/858d6d91e6d04cb26acb51fcb516f9c1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0d4755125431b2df6a5232950b6c475bb6ae459a35503d64a6bc2c8075f5e2e5/
Threat name:
Win32.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-08-08 15:55:33 UTC
File Type:
PE (Exe)
Extracted files:
375
AV detection:
14 of 38 (36.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bvdvkesuggzn62ssgkkqw3chlo3k4rm2gvid2zfgxqwia5pv4lsq._file
Verdict:
malicious
Label(s):
DonutLoader
Create hunting rule
Link:
https://reports.threatray.com/e234124d-45a3-4646-bba3-8265208973da
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution installer ransomware
Link:
https://tria.ge/reports/260808-tcykfatycs/
Behaviour
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
Executes a command shell one-liner
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Discovers running processes
Executes dropped EXE
Loads dropped DLL
Command and Scripting Interpreter: PowerShell
Unpacked files
SH256 hash:
0d4755125431b2df6a5232950b6c475bb6ae459a35503d64a6bc2c8075f5e2e5
MD5 hash:
858d6d91e6d04cb26acb51fcb516f9c1
SHA1 hash:
6790e1cbf6798382504915d09bbf8b5aacc10dfe
Link:
https://www.unpac.me/results/ec9f72b4-94fd-4368-a9bc-a35a18b2abec/
SH256 hash:
874ccab046c875408a75965f4d7be5cb162a4b30db91034d1558ef543e140d4a
MD5 hash:
67252e1970be1ce02791c0da5b9ddc31
SHA1 hash:
46e993c22b10b6d095f2770c5861ee1c272cb43c
Link:
https://www.unpac.me/results/ec9f72b4-94fd-4368-a9bc-a35a18b2abec/
SH256 hash:
ad5ac20dec8fdb7ab24a6df197e697fb33b7ab63cbbb5e39fe9379637b9e2438
MD5 hash:
46914aea185f8d0ae6240924f909dc6f
SHA1 hash:
ec6493048e6ae511ad1b0dcf0328c221f7e160a1
Link:
https://www.unpac.me/results/ec9f72b4-94fd-4368-a9bc-a35a18b2abec/
SH256 hash:
480184452f80f632d70a41d259f5c014215c9f858ced981910c363fe573cc49f
MD5 hash:
a54db25f487ef61a667174fa55d0e8d2
SHA1 hash:
d97a4065013ebaf7fd6858d2cb4ab21016c32eee
Detections:
win_flawedammyy_auto
Create hunting rule
Link:
https://www.unpac.me/results/ec9f72b4-94fd-4368-a9bc-a35a18b2abec/
Parent samples :
63e8c18d647c49586bbea5bebed20a710bf669a3282846efbe053690e563c84b
35dab11414d17ad15b9992ba51ad57fc768fd3f4fc449d50fce08b2c46cbe270
cba8e79b90c98fe396da2d0243e1c98b13bdf586b8e60034be52fe6efdc42ce8
20343f047964ef95901941b2406ee66ec976e2d849abbe991f94b6a0fe634881
22a936860e45162049f713f1305e801899f8eb47a13fdb3504cf978a456efc16
588cdd2ac6167b34eaac919a31bf18ca7831183da6b1c2eccc5966808c2b3733
3515de6eccfc4e2b39dd34a21b1e7501673d598792b797907f40683ffb081592
0d4755125431b2df6a5232950b6c475bb6ae459a35503d64a6bc2c8075f5e2e5
SH256 hash:
17cac696692061a74b0ae62df2968910500ccb593f0ca2b8bc7a26da58cfb8c3
MD5 hash:
73d5931e3d54e7ef349d79da721da321
SHA1 hash:
d4db90b23e59fbdcca7fe5123bfd21a2a6018e34
Link:
https://www.unpac.me/results/ec9f72b4-94fd-4368-a9bc-a35a18b2abec/
SH256 hash:
a0cac4cf4852895619bc7743ebeb89f9e4927ccdb9e66b1bcd92a4136d0f9c77
MD5 hash:
b0c77267f13b2f87c084fd86ef51ccfc
SHA1 hash:
f7543f9e9b4f04386dfbf33c38cbed1bf205afb3
Link:
https://www.unpac.me/results/ec9f72b4-94fd-4368-a9bc-a35a18b2abec/
SH256 hash:
b22c8f676dec58be8d25fbad1a37835ffc4029f29aaf79f4dc0337ca73a38782
MD5 hash:
1f49d8af9be9e915d54b2441c4a79adf
SHA1 hash:
1ee4f809c693e31f34bc6d8153664a6dc2c3e499
Detections:
win_flawedammyy_auto
Create hunting rule
Link:
https://www.unpac.me/results/ec9f72b4-94fd-4368-a9bc-a35a18b2abec/
Parent samples :
35dab11414d17ad15b9992ba51ad57fc768fd3f4fc449d50fce08b2c46cbe270
cba8e79b90c98fe396da2d0243e1c98b13bdf586b8e60034be52fe6efdc42ce8
20343f047964ef95901941b2406ee66ec976e2d849abbe991f94b6a0fe634881
22a936860e45162049f713f1305e801899f8eb47a13fdb3504cf978a456efc16
588cdd2ac6167b34eaac919a31bf18ca7831183da6b1c2eccc5966808c2b3733
0d4755125431b2df6a5232950b6c475bb6ae459a35503d64a6bc2c8075f5e2e5
Malware family:
DonutLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/0d4755125431/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0d4755125431b2df6a5232950b6c475bb6ae459a35503d64a6bc2c8075f5e2e5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Ins_NSIS_Buer_Nov_2020_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect NSIS installer used for Buer loader
Rule name:NSIS
Create hunting rule
Author:kevoreilly
Description:NSIS Integrity Check function
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:reverse_http
Create hunting rule
Author:CD_R0M_
Description:Identify strings with http reversed (ptth)
Rule name:SuspiciousDll
Create hunting rule
Author:martclau
Description:Detects SolarWinds Orion backdoor
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:test_Malaysia
Create hunting rule
Author:rectifyq
Description:Detects file containing malaysia string
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:Windows_Shellcode_Rdi_918f8e2f
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_CobaltStrike_f0b627fc
Create hunting rule
Description:Rule for beacon reflective loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ValleyRAT

Executable exe 0d4755125431b2df6a5232950b6c475bb6ae459a35503d64a6bc2c8075f5e2e5

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/79244/

Comments