MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b3d01d49abdc244eb20b3a505d439be4e65df9ba52e8de876e70c5b987a403a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ValleyRAT

Vendor detections: 15

Intelligence 15 IOCs 1 YARA 18 File information Comments

SHA256 hash:	1b3d01d49abdc244eb20b3a505d439be4e65df9ba52e8de876e70c5b987a403a
SHA3-384 hash:	7fe41cd29d7d5bc6f50502669c41c4cca6341c30cf5ed1ed9f4ee28030371b86b356eebab46d1c5d107e4f05a66ff44b
SHA1 hash:	f6e79fad22f1ce9850ba4eabaf74a6b08836eb2c
MD5 hash:	3020e415dd4f6f5fa5e5a00e4a5e5cc0
humanhash:	gee-minnesota-maine-hot
File name:	Windows安装包.exe
Download:	download sample
Signature	ValleyRAT Create hunting rule
File size:	559'068 bytes
First seen:	2025-06-29 04:41:20 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	00be6e6c4f9e287672c8301b72bdabf3 (116 x RedLineStealer, 70 x AsyncRAT, 55 x AgentTesla)
ssdeep	12288:pcrNS33L10QdrXAUVnMLb6autePxaV1DeITMGDbaqf4VOF:UNA3R5drXHVeBuIPxaV1/Ms6q
Threatray	2'822 similar samples on MalwareBazaar
TLSH	T164C4F111B6C184F2E5330D355A2AB721A4BCBE211F24DA2FB7D43E5DCA31191A335AB7
TrID	32.2% (.EXE) Win64 Executable (generic) (10522/11/4) 20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 15.4% (.EXE) Win16 NE executable (generic) (5038/12/1) 13.7% (.EXE) Win32 Executable (generic) (4504/4/1) 6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
dhash icon	0f2c3753772b0b19 (1 x ValleyRAT)
Reporter	GDHJDSYDH1
Tags:	backdoor exe SilverFox ValleyRAT winos

GDHJDSYDH1

C2:
161.248.87.240:3005
45.204.214.201:3006
More Reference: https://tria.ge/250629-e6zbha1pv7/behavioral1

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
45.204.214.201:3006	https://threatfox.abuse.ch/ioc/1551283/

Intelligence

File Origin

# of uploads :

# of downloads :

520

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

Windows.exe

Verdict:

Malicious activity

Analysis date:

2025-06-29 04:33:51 UTC

Tags:

sfx dropper valleyrat winos rat silverfox

Link:

https://app.any.run/tasks/c06667bc-5d3d-4fbe-87cb-7dae63352857

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/11510/

Detection(s):

SecuriteInfo.com.Troj.NanoCo_TZ.22029.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6860c22e37c343677947019b

Tags:

farfli emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Searching for the window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file

Creating a process from a recently created file

Launching a process

Creating a process with a hidden window

Creating a file in the Windows subdirectories

Connection attempt

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Enabling autorun by creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

crypto evasive farfli fingerprint installer microsoft_visual_cc obfuscated overlay overlay packed packer_detected sfx xor-pe

Link:

https://www.filescan.io/uploads/6860c43545e80b29f8a427e4/reports/860470c0-00bd-42b6-9205-459f8593d083/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_60%

Link:

https://www.hybrid-analysis.com/sample/1b3d01d49abdc244eb20b3a505d439be4e65df9ba52e8de876e70c5b987a403a

Malware family:

Winos

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/d772f210-5ec1-4376-ba0e-e44377e8531e

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/1b3d01d49abdc244eb20b3a505d439be4e65df9ba52e8de876e70c5b987a403a

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) Win 32 Exe x86

Link:

https://app.malva.re/file/3020e415dd4f6f5fa5e5a00e4a5e5cc0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1b3d01d49abdc244eb20b3a505d439be4e65df9ba52e8de876e70c5b987a403a/

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/1b3d01d49abdc244eb20b3a505d439be4e65df9ba52e8de876e70c5b987a403a

Threat name:

Win32.Backdoor.Farfli

Status:

Malicious

First seen:

2025-06-29 04:33:52 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

20 of 24 (83.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dm6qdve2xxbej2zawosqlvbzxzhglx43uuxi32dw44gfxgd2ia5a._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery execution

Link:

https://tria.ge/reports/250629-fbwgssfl6y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Command and Scripting Interpreter: PowerShell

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Hide Artifacts: Ignore Process Interrupts

Checks computer location settings

Executes dropped EXE

Verdict:

Informative

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/e46ca2f7-a853-48b4-be0b-85ec9c71bc0c

Unpacked files

SH256 hash:

5d91b46e4119836db5293074c6c945bdf676ab5fe0e2d1e649c5f97ea1d4d92b

MD5 hash:

57346c92262580281a91afb118401003

SHA1 hash:

92282a0694733fce3d65e2931f854e06943dc915

Detections:

malw_eicar

eicar_substring_test

SUSP_XORed_MSDOS_Stub_Message

Link:

https://www.unpac.me/results/9edb7947-f5f9-45c9-96ac-6bee6bde19ac/

SH256 hash:

4842615e29c32b681db2b94cd9a40bf01783345ea9ad3707581831187bf282f5

MD5 hash:

38d05643f66650ba5fe25ed49044efa9

SHA1 hash:

b97cd3dbce4a4acb1ac525bc1eb6501a870ed3db

Detections:

win_valley_rat_auto

Link:

https://www.unpac.me/results/9edb7947-f5f9-45c9-96ac-6bee6bde19ac/

SH256 hash:

1b3d01d49abdc244eb20b3a505d439be4e65df9ba52e8de876e70c5b987a403a

MD5 hash:

3020e415dd4f6f5fa5e5a00e4a5e5cc0

SHA1 hash:

f6e79fad22f1ce9850ba4eabaf74a6b08836eb2c

Link:

https://www.unpac.me/results/9edb7947-f5f9-45c9-96ac-6bee6bde19ac/

Malware family:

EICAR

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/1b3d01d49abd/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1b3d01d49abdc244eb20b3a505d439be4e65df9ba52e8de876e70c5b987a403a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	dcrat_ Create hunting rule
Author:	Michelle Khalil
Description:	This rule detects unpacked dcrat malware samples.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_peb_parsing Create hunting rule
Author:	Willi Ballenthin

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SelfExtractingRAR Create hunting rule
Author:	Xavier Mertens
Description:	Detects an SFX archive with automatic script execution

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	win32_younglotus Create hunting rule
Author:	Reedus0
Description:	Rule for detecting YoungLotus malware

Rule name:	Windows_Generic_Threat_4b0b73ce Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Shellcode_Rdi_eee75d2c Create hunting rule
Author:	Elastic Security

Rule name:	Windows_Trojan_Winos_464b8a2e Create hunting rule
Author:	Elastic Security

Rule name:	win_valley_rat_auto Create hunting rule
Author:	Felix Bilstein - yara-signator at cocacoding dot com
Description:	Detects win.valley_rat.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ValleyRAT

exe 1b3d01d49abdc244eb20b3a505d439be4e65df9ba52e8de876e70c5b987a403a

(this sample)

any.run

https://app.any.run/tasks/c06667bc-5d3d-4fbe-87cb-7dae63352857

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/11510/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
GDI_PLUS_API	Interfaces with Graphics	gdiplus.dll::GdiplusStartup gdiplus.dll::GdiplusShutdown gdiplus.dll::GdipAlloc
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryExA KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetSystemInfo KERNEL32.dll::GetStartupInfoW
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::AllocConsole KERNEL32.dll::AttachConsole KERNEL32.dll::WriteConsoleW KERNEL32.dll::FreeConsole KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleMode KERNEL32.dll::GetConsoleCP
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CreateDirectoryW KERNEL32.dll::CreateHardLinkW KERNEL32.dll::CreateFileW KERNEL32.dll::CreateFileMappingW KERNEL32.dll::DeleteFileW KERNEL32.dll::MoveFileW KERNEL32.dll::MoveFileExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample