MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2935b3d7fe05f60261e5a0d57f78f2b12961126ba4caee260f720d2f15f35d8f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ValleyRAT

Vendor detections: 14

Intelligence 14 IOCs YARA 8 File information Comments

SHA256 hash:	2935b3d7fe05f60261e5a0d57f78f2b12961126ba4caee260f720d2f15f35d8f
SHA3-384 hash:	a699e0542f841bc96ebfdd925e5e67c9e2565983860fe77a8a2cf405e08adc0042c70c2453ada0cbe20172912bd559f9
SHA1 hash:	8e42d8b6b8ea8d38ee95f2a3b6baee1164c9216b
MD5 hash:	ad911be3233cda07dac41e3edcb408b6
humanhash:	lemon-quebec-nebraska-johnny
File name:	Setup.exe
Download:	download sample
Signature	ValleyRAT Create hunting rule
File size:	27'849'903 bytes
First seen:	2026-10-16 15:45:56 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	5a594319a0d69dbc452e748bcf05892e (32 x Gh0stRAT, 21 x ParallaxRAT, 15 x NetSupport)
ssdeep	786432:Kjfu1Z/xpnztBL+bWOYqbcmZ5v5i3hvm83ooj3:sIJWnRihmOpj3
TLSH	T11057333BB268213ED4DB073156B3826088BB76A1F91A8C5B57F4090DDF379A11E3B356
TrID	49.2% (.EXE) Inno Setup installer (107240/4/30) 19.7% (.EXE) InstallShield setup (43053/19/16) 19.1% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 3.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 2.9% (.EXE) Win64 Executable (generic) (6522/11/2)
Magika	pebin
dhash icon	b298acbab2ca7a72 (2'335 x GCleaner, 1'831 x Socks5Systemz, 67 x RedLineStealer)
Reporter	Ling
Tags:	exe SilverFox ValleyRAT

CNGaoLing

The sample is retrieved from "https://ludashiapp.com.cn" -> "https://kuake.org.cn/download/win-Bundle%20x643014.zip" -> Setup.exe

SilverFox
IOC (IP 134.122.183.131 :52841 / :52843)

Intelligence

File Origin

# of uploads :

# of downloads :

217

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/14250683-fc47-49d9-b1dd-5cd035926156/

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/92282/

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad246dcf4e17c78f7162c96

Tags:

dropper emotet shell sage

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a window

Creating a process from a recently created file

Creating synchronization primitives

Searching for synchronization primitives

Creating a file

Moving a recently created file

Creating a process with a hidden window

Using the Windows Management Instrumentation requests

Sending a custom TCP request

Launching a process

Deleting a recently created file

Loading a suspicious library

Connection attempt

Enabling autorun by creating a file

Unauthorized injection to a system process

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm crypto embarcadero_delphi expired-cert fingerprint inno installer installer reconnaissance

Link:

https://www.filescan.io/uploads/6ad246d8a243d27b5f265367/reports/ea0ff4e7-0bec-4759-8a0b-f2a404306de8/overview

Verdict:

Malicious

Link:

https://www.hybrid-analysis.com/sample/2935b3d7fe05f60261e5a0d57f78f2b12961126ba4caee260f720d2f15f35d8f

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-10-15T15:17:00Z UTC

Last seen:

2026-10-18T12:55:00Z UTC

Hits:

~100

Detections:

Trojan.Win64.Zenpak.sb Trojan.Win64.Kryplod.sb Backdoor.Win32.Xkcp.a Trojan.Win32.DLLhijack.sb Trojan.Win32.DLLhijack.assb Backdoor.Xkcp.TCP.ServerRequest Backdoor.Win32.Xkcp.dya Backdoor.Agent.TCP.C&C

Link:

https://opentip.kaspersky.com/2935b3d7fe05f60261e5a0d57f78f2b12961126ba4caee260f720d2f15f35d8f/results?tab=lookup

Score:

44%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/2935b3d7fe05f60261e5a0d57f78f2b12961126ba4caee260f720d2f15f35d8f

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/ad911be3233cda07dac41e3edcb408b6

Gathering data

Threat name:

Win32.Trojan.Kepavll

Status:

Malicious

First seen:

2026-10-15 21:19:56 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

15 of 24 (62.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fe23hv76ax3aeypfudkx66hsweuwcetlutfo4jqpoigs6fptlwhq._file

Verdict:

malicious

Label(s):

ValleyRAT

Link:

https://reports.threatray.com/5e0bb20b-5d8b-463d-ba89-0048d5cbf617

Result

Malware family:

valleyrat_s2

Score:

10/10

Tags:

family:valleyrat_s2 backdoor defense_evasion discovery execution installer persistence privilege_escalation ransomware

Link:

https://tria.ge/reports/261016-s7tz3agy2k/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of UnmapMainImage

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

Inno Setup is an open-source installation builder for Windows applications.

System Location Discovery: System Language Discovery

Drops file in System32 directory

Enumerates connected drives

Executes dropped EXE

Loads dropped DLL

Command and Scripting Interpreter: PowerShell

Detects ValleyRAT payload

Family: ValleyRat

Malware Config

C2 Extraction:

134.122.183.131:52841
134.122.183.131:52843

Malware family:

ValleyRAT

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/2935b3d7fe05/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2935b3d7fe05f60261e5a0d57f78f2b12961126ba4caee260f720d2f15f35d8f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	MULTI_Malware_AgentTesla_ForgeAuto_ed343f78_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects AgentTesla (inconnu, etat extrait)

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	WIN_Malware_Unknown_ForgeAuto_1708427c_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_4ab123d7_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_6422f546_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_f5d58a9e_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ValleyRAT

exe 2935b3d7fe05f60261e5a0d57f78f2b12961126ba4caee260f720d2f15f35d8f

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/92282/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample