MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1d8293c80e7babab16034a4e41cad4e52f2e76c4be59add9a2599124e102f1cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1d8293c80e7babab16034a4e41cad4e52f2e76c4be59add9a2599124e102f1cc
SHA3-384 hash: 2a893d49aaa0d3474ccd79357c02d79d4c6a79713102cf2ac9afacf96a25ffedb5c1cfe9406c977583b53e9de28ee7d1
SHA1 hash: 822cf65c9e1b534170aa9230ec315f92685405a4
MD5 hash: 0fe8010697c81a96347f2ccf7a5d0c76
humanhash: pluto-papa-cardinal-mockingbird
File name:0FE8010697C81A96347F2CCF7A5D0C76.dll
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:1'172'480 bytes
First seen:2025-12-27 15:55:10 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash dd9853cde01ba28923c502ddf1a65984 (1 x ValleyRAT)
ssdeep 24576:YlvGCPoVPDSoIrdMUFaz0BnXogrrt4egh5rRtXwkeP:YBPwbSvFK4ogrrrgzn
TLSH T1EC45F19361710055E1F6CC3DCA3BBEF032FA1A338E42ACB955AD59C61A619E0F317A52
TrID 45.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
15.4% (.EXE) Win64 Executable (generic) (10522/11/4)
9.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
7.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
6.6% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter abuse_ch
Tags:dll RAT ValleyRAT


Avatar
abuse_ch
ValleyRAT C2:
203.91.74.3:443

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
203.91.74.3:443 https://threatfox.abuse.ch/ioc/1687166/

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/46230/
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6950016ac157fc7de718efa7
Tags:
vmprotect virus
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug obfuscated packed packed packed vmprotect
Link:
https://www.filescan.io/uploads/69500169e126b9ff43933bf2/reports/df78d815-212d-42ec-bb2a-7c2063d81233/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/1d8293c80e7babab16034a4e41cad4e52f2e76c4be59add9a2599124e102f1cc
Verdict:
Malicious
File Type:
dll x32
First seen:
2025-12-25T13:37:00Z UTC
Last seen:
2025-12-29T00:53:00Z UTC
Hits:
~10
Detections:
PDM:Trojan.Win32.Generic Backdoor.Win32.Agent.sb Backdoor.Win32.Agent.myxbyv
Link:
https://opentip.kaspersky.com/1d8293c80e7babab16034a4e41cad4e52f2e76c4be59add9a2599124e102f1cc/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/41468c08-3f53-43b6-90e6-ad9fc099e8ce
Result
Threat name:
ValleyRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
84 / 100
Link:
https://www.joesandbox.com/analysis/1840316
Signature
Contains functionality to capture and log keystrokes
Found evasive API chain (may stop execution after checking mutex)
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected ValleyRAT
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/1d8293c80e7babab16034a4e41cad4e52f2e76c4be59add9a2599124e102f1cc
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/0fe8010697c81a96347f2ccf7a5d0c76
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1d8293c80e7babab16034a4e41cad4e52f2e76c4be59add9a2599124e102f1cc/
Verdict:
Malicious
Threat:
Family.VALLEYRAT
Link:
https://tip.neiki.dev/file/1d8293c80e7babab16034a4e41cad4e52f2e76c4be59add9a2599124e102f1cc
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-12-25 18:23:16 UTC
File Type:
PE (Dll)
Extracted files:
1
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dwbjhsaopov2wfqdjjhedswu4uxs45wexzm23wnclgisjyic6hga._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/251227-tcykfagr3t/
Behaviour
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Unpacked files
SH256 hash:
1d8293c80e7babab16034a4e41cad4e52f2e76c4be59add9a2599124e102f1cc
MD5 hash:
0fe8010697c81a96347f2ccf7a5d0c76
SHA1 hash:
822cf65c9e1b534170aa9230ec315f92685405a4
Link:
https://www.unpac.me/results/64b72806-34f6-4a36-9abd-00bcc18614ee/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/1d8293c80e7babab16034a4e41cad4e52f2e76c4be59add9a2599124e102f1cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_EXE_Packed_VMProtect
Create hunting rule
Author:ditekSHen
Description:Detects executables packed with VMProtect.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/46230/

Comments