MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 18c28bc69f6627d6e5304aff5d09d0e057d8aa744b95b0a902fed080ab62d765. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 16


Intelligence 16 IOCs 1 YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 18c28bc69f6627d6e5304aff5d09d0e057d8aa744b95b0a902fed080ab62d765
SHA3-384 hash: 94a1379c2606ca49c294b945044a51c5c17bfc3b6e77df761d25a15d114996578c758e72b7c9b6017abf194c6352ecf4
SHA1 hash: 9c107a6b2d5bc5bdbff5780b324ece2aede9308e
MD5 hash: ec9a9148d695ddb9ab9f269654adb3be
humanhash: november-alpha-music-sweet
File name:18c28bc69f6627d6e5304aff5d09d0e057d8aa744b95b.exe
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:872'448 bytes
First seen:2025-09-29 14:30:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f1d68f13e14496466705d4cc79d85eba (1 x ValleyRAT)
ssdeep 24576:xTCcnksR09SMh2q1lSboKYYZhh/HHssuVT:x2HXSMhHMo0ZEpN
Threatray 134 similar samples on MalwareBazaar
TLSH T14705CFBFF4E4166DC5C9C834A30612E3F571BCDA14246C7F52D0B261AF74EA11F2A62A
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter abuse_ch
Tags:exe RAT ValleyRAT


Avatar
abuse_ch
ValleyRAT C2:
148.66.7.234:442

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
148.66.7.234:442 https://threatfox.abuse.ch/ioc/1558260/

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
18c28bc69f6627d6e5304aff5d09d0e057d8aa744b95b0a902fed080ab62d765.exe
Verdict:
No threats detected
Analysis date:
2025-09-29 14:13:01 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/4ae776de-f343-44b3-a9cf-526bfc4c6bdb

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/29469/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68da98227d643f33eab8bda8
Tags:
emotet spawn shell sage
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
DNS request
Connection attempt
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Creating a window
Unauthorized injection to a system process
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug expand lolbin packed
Link:
https://www.filescan.io/uploads/68da982ac564c8e81d0a095a/reports/27723a52-e514-4986-bfb1-d18d6670e7f7/overview
Verdict:
Malicious
Labled as:
Win64/GenKryptik_AGeneric.AZA trojan
Link:
https://www.hybrid-analysis.com/sample/18c28bc69f6627d6e5304aff5d09d0e057d8aa744b95b0a902fed080ab62d765
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-09-29T05:03:00Z UTC
Last seen:
2025-09-29T05:03:00Z UTC
Hits:
~100
Detections:
Backdoor.Agent.TCP.C&C Trojan-PSW.Win32.Stealer.sb Trojan-PSW.Win32.Coins.sb Trojan.Win64.DonutInjector.sb Trojan.Win32.Shellcode.ftu PDM:Trojan.Win32.Generic Backdoor.Win32.Xkcp.a Backdoor.Win32.Agentb.sb Trojan.Win64.Donut.sb Trojan.Win32.Shellcode.sb Trojan.Win32.PoolInject.sba
Link:
https://opentip.kaspersky.com/18c28bc69f6627d6e5304aff5d09d0e057d8aa744b95b0a902fed080ab62d765/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/3f500114-ec59-4fe5-a093-e61c9c2fba58
Result
Threat name:
ValleyRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1786020
Signature
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Contains functionality to capture and log keystrokes
Contains functionality to detect sleep reduction / modifications
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Found direct / indirect Syscall (likely to bypass EDR)
Found evasive API chain (may stop execution after checking mutex)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Found stalling execution ending in API Sleep call
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Tries to access browser extension known for cryptocurrency wallets
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Writes to foreign memory regions
Yara detected ValleyRAT
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/18c28bc69f6627d6e5304aff5d09d0e057d8aa744b95b0a902fed080ab62d765
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/18c28bc69f6627d6e5304aff5d09d0e057d8aa744b95b0a902fed080ab62d765/
Verdict:
Malicious
Threat:
Family.DONUTLOADER
Link:
https://tip.neiki.dev/file/18c28bc69f6627d6e5304aff5d09d0e057d8aa744b95b0a902fed080ab62d765
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-09-29 10:01:21 UTC
File Type:
PE+ (Exe)
AV detection:
22 of 37 (59.46%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ddbixru7myt5nzjqjl7v2coq4bl5rktujok3bkic73iibk3c25sq._file
Verdict:
malicious
Label(s):
valleyrat
Create hunting rule
Similar samples:
18c28bc69f6627d6e5304aff5d09d0e057d8aa744b95b0a902fed080ab62d765
ValleyRAT
1cc62d774236839a8067b217ed9844b475d78eca9b27c5f6419ad1ffa35b9d64
ValleyRAT
7fd0dcab090cc3010a5cd6d1be51d3fb1f7c50324ef7b35f36d0f149ab320899
ValleyRAT
94844625f53130eb85f7534bd19c1f4d33706179b75ac91823d6411eca7f4338
ValleyRAT
a867e908995563dad71a115e74f73d0449ba21dc62310b2e0b2e179e399a4d73
ValleyRAT
c8e8d9c72b572aa237d3fbbca03b8ea20c9c01a747262c4266fbb86e5db46589
ValleyRAT
d7adfc9774a6f8f2e40da98960bbaaefd6851a362ed0953281df63a449c9bff1
ValleyRAT
d9fc8a250c4c26b6a6dc51ba7c9562245e199aa622dd955802fdb954326c76b8
ValleyRAT
dd18a62c3dd7f48ddabf288d271cad000e51d629c17f1e5f70127b3dc117ed30
ValleyRAT
error
ValleyRAT
+ 124 additional samples on MalwareBazaar
Result
Malware family:
donutloader
Create hunting rule
Score:
  10/10
Tags:
family:donutloader loader
Link:
https://tria.ge/reports/250929-rvlx9ahj8s/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Detects DonutLoader
DonutLoader
Donutloader family
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/062091ab-2549-46c4-828f-5a0b34b01af4
Unpacked files
SH256 hash:
18c28bc69f6627d6e5304aff5d09d0e057d8aa744b95b0a902fed080ab62d765
MD5 hash:
ec9a9148d695ddb9ab9f269654adb3be
SHA1 hash:
9c107a6b2d5bc5bdbff5780b324ece2aede9308e
Link:
https://www.unpac.me/results/3c28c2f3-7654-4329-8dcf-01c31c752fdb/
Malware family:
ValleyRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/18c28bc69f66/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/18c28bc69f6627d6e5304aff5d09d0e057d8aa744b95b0a902fed080ab62d765

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ProgramLanguage_Rust
Create hunting rule
Author:albertzsigovits
Description:Application written in Rust programming language
Rule name:Rustyloader_mem_loose
Create hunting rule
Author:James_inthe_box
Description:Corroded buerloader
Reference:https://app.any.run/tasks/83064edd-c7eb-4558-85e8-621db72b2a24
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/29469/

Comments