MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 19fba13375784918bd8880efbb95cd8f8dbc7402b445ec828fcb09f3a7722cdc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	19fba13375784918bd8880efbb95cd8f8dbc7402b445ec828fcb09f3a7722cdc
SHA3-384 hash:	79037a623f5364abfb3bc7c6ca3ddc1dcf5c4be7accf2f078ca41e395d5bdf954e56a7e182cfc10b40d7d0851f3fcb2d
SHA1 hash:	4a3a2e1e689adfe041683346563e9363cfe09fae
MD5 hash:	02ca806f6e752e6e6cda0d7d489dc02a
humanhash:	connecticut-early-table-nine
File name:	Google AI Browser v1.5.4.msi
Download:	download sample
Signature	ValleyRAT Alert Create hunting rule
File size:	83'896'320 bytes
First seen:	2025-04-11 15:02:28 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	1572864:Zn5hK9CK1PQPvnJ2NmMiFd49SqWsw2HPt1sJc8g9HLWVOl/ONwXVW9v6TNYMmkhw:B5o9CfPvnvMiQwqWswGsJiqVOANwAM
TLSH	T1CA08337336558A3AE28F79B0613B5A0E4901BC934B7150CBE796BD3EE13F5C2A4706D2
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	aachum
Tags:	148-66-11-18 msi ValleyRAT winos

iamaachum

https://chro8.wenxinwl.top/ => https://s3.ap-east-1.amazonaws.com/sdsd412.aws/Google_AI_Browser_v1.5.4.zip

ValleyRAT C2:
148.66.11.18:6666
148.66.11.18:7777

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

85

Origin country :

ES

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67f92d1ad6e7c3effad014b6

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

adaptive-context anti-debug cmd crypto expired-cert fingerprint lolbin remote wix

Link:

https://www.filescan.io/uploads/67f92f32b070fb3f94627796/reports/033d435b-ada5-468b-9997-df620d87f931/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/19fba13375784918bd8880efbb95cd8f8dbc7402b445ec828fcb09f3a7722cdc

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/19fba13375784918bd8880efbb95cd8f8dbc7402b445ec828fcb09f3a7722cdc

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Joe Sandbox clean

Result

Threat name:

n/a

Detection:

clean

Classification:

n/a

Score:

2 / 100

Link:

https://www.joesandbox.com/analysis/1663315

Behaviour

Behavior Graph:

n/a

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/19fba13375784918bd8880efbb95cd8f8dbc7402b445ec828fcb09f3a7722cdc

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win32.Backdoor.Farfli

Threat name:

Win32.Backdoor.Farfli

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-04-11 14:54:17 UTC

File Type:

Binary (Archive)

Extracted files:

4274

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dh52cm3vpberrpmiqdx3xfonr6g3y5acwrc6zaupzme7hj3sftoa._file

Threatray winos

Verdict:

malicious

Label(s):

winos

Alert

Create hunting rule

Similar samples:

error

ValleyRAT

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

discovery

Link:

https://tria.ge/reports/250411-se4zkasqx6/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Loads dropped DLL

Enumerates connected drives

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/48f2e403-baa4-40af-a795-5742a7433790

VMRay ValleyRAT

Malware family:

ValleyRAT

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/19fba1337578/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.