MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2530025bd1fced9443a32079db97f9023a11968ec353f52adf73a8da0edd9daa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2530025bd1fced9443a32079db97f9023a11968ec353f52adf73a8da0edd9daa
SHA3-384 hash:	5982df029b0302622c16f820842026652a76eb31120140b5637d16b8de5a64e05990fd2e013ebbcb59326f08efbb4bc9
SHA1 hash:	db0904375f3026ce50e1bb07fe6ed4f1006e6268
MD5 hash:	b88936cd4961274cf75bf1fef809dae7
humanhash:	blue-autumn-london-edward
File name:	ChoneSetup_jgoliud_win.msi
Download:	download sample
Signature	ValleyRAT Alert Create hunting rule
File size:	87'337'984 bytes
First seen:	2026-03-15 02:42:51 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	1572864:2yGVjCC73Btwc2bidiL7r4j7fQnywSII/H+TGS1/5Fev43wIWpoKz0x3v5SCE:gpCCbBnbdXjLH5/zYTevh3Lz09sCE
TLSH	T139183321B566A9B5FA2FA37FA0A4DF9950317EE03337D5D723783B964AB058120B1D03
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	Ling
Tags:	msi SilverFox Suschil Trojan:Win32/Suschil!rfn ValleyRAT

CNGaoLing

This sample has been reviewed by Microsoft researchers and determined to be malware. (Trojan:Win32/Suschil!rfn)

SilverFox
IOC (Domain wenfengas68.com) (IP 8.210.49.79)

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

96

Origin country :

US

Vendor Threat Intelligence

ACCE MSI_FileType

Details

Link:

https://research.acce.ciphertechsolutions.com/results/865ed390-541d-4d96-8022-478fe2fb5986/

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69b61ce293b644ca466a291e

Tags:

virus spawn blic

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug anti-vm at base64 CAB cmd evasive expired-cert expired-cert explorer explorer findstr fingerprint fingerprint fingerprint installer large-file lolbin lolbin overlay packed rundll32 wix

Link:

https://www.filescan.io/uploads/69b61cd6677ac46843a5356f/reports/32962b49-a6b1-4852-9aaa-2787b60fdbc3/overview

Hybrid Analysis Trojan.MSI.Agent

Verdict:

Malicious

Labled as:

Trojan.MSI.Agent

Link:

https://www.hybrid-analysis.com/sample/2530025bd1fced9443a32079db97f9023a11968ec353f52adf73a8da0edd9daa

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/2530025bd1fced9443a32079db97f9023a11968ec353f52adf73a8da0edd9daa

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

msi

Detections:

Trojan.Win64.Agent.smfqvf Trojan.Win64.Agent.sb Trojan.Win32.Shellcode.sb Trojan.Win32.Agent.xccvws Trojan.OLE2.Agent.sb

Link:

https://opentip.kaspersky.com/2530025bd1fced9443a32079db97f9023a11968ec353f52adf73a8da0edd9daa/results?tab=lookup

Nucleon Malprob Benign

Score:

27%

Verdict:

Benign

File Type:

ARCHIVE

Link:

https://malprob.io/report/2530025bd1fced9443a32079db97f9023a11968ec353f52adf73a8da0edd9daa

CERT.PL MWDB

Gathering data

Neiki Family.DONUTLOADER

Verdict:

Malicious

Threat:

Family.DONUTLOADER

Link:

https://tip.neiki.dev/file/2530025bd1fced9443a32079db97f9023a11968ec353f52adf73a8da0edd9daa

ReversingLabs TitaniumCloud Win64.Trojan.Suschil

Threat name:

Win64.Trojan.Suschil

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-13 14:38:51 UTC

AV detection:

12 of 38 (31.58%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=euyaew6r7twziq5deb45xf7zai5bdfuoynj7kkw7oounudw5twva._file

Threatray donutloader

Verdict:

malicious

Label(s):

donutloader

Alert

Create hunting rule

Similar samples:

error

ValleyRAT

Hatching Triage valleyrat_s2

Result

Malware family:

valleyrat_s2

Alert

Create hunting rule

Score:

  10/10

Tags:

family:donutloader family:valleyrat_s2 backdoor discovery execution loader persistence privilege_escalation ransomware

Link:

https://tria.ge/reports/260315-c7wkwsgs9v/

Behaviour

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Enumerates physical storage devices

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Suspicious use of SetThreadContext

Badlisted process makes network request

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

Detects DonutLoader

Detects ValleyRAT payload

DonutLoader

Donutloader family

ValleyRat

Valleyrat_s2 family

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2530025bd1fc/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.