MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b371117fd3dc235ab72fa57397da7ed522ab65c665b2b0d62526ceafa3aa2c3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ValleyRAT

Vendor detections: 11

Intelligence 11 IOCs YARA 27 File information Comments

SHA256 hash:	2b371117fd3dc235ab72fa57397da7ed522ab65c665b2b0d62526ceafa3aa2c3
SHA3-384 hash:	c3e06a45afa20e5cbb7206c7d571c9f472ed1a88727252d6e9719689db229778dee867f328bece6f4f4e0c288e3f5b89
SHA1 hash:	a2d518da5c2c73c5f209cec920532d756e7d931f
MD5 hash:	1813869bc6abb707250d89ae8b57ccb1
humanhash:	crazy-lion-michigan-blossom
File name:	爱接码平台客户端.exe
Download:	download sample
Signature	ValleyRAT Create hunting rule
File size:	4'255'102 bytes
First seen:	2026-09-01 03:29:56 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	88016fcdef7f227c62171d0afad9aae4 (23 x ValleyRAT, 17 x OffLoader, 11 x Tofsee)
ssdeep	49152:puI2h0/UpSX/OSU/arO4Eo2uVryCoEjXecfxGeJF82hbNYFWfoSL3rdf/rVltjkY:p5O0/DlEarZEo2ayCoAppHJm2rJztF
TLSH	T15416023FB28B653EE06A5A367A76A210553F766165138C16D7F4C88CCF250B01E3FB86
TrID	61.4% (.EXE) Inno Setup installer (107240/4/30) 23.8% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 3.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 3.7% (.EXE) Win64 Executable (generic) (6522/11/2) 2.5% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	a24d8d35373e3025 (1 x ValleyRAT)
Reporter	Ling
Tags:	exe SilverFox ValleyRAT

CNGaoLing

SilverFox
IOC (IP 118.107.43.190 :3190 / :7858)

Intelligence

File Origin

# of uploads :

# of downloads :

206

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/de9cea48-34d2-4e96-9703-3e56df9c92cf/

Malware family:

n/a

ID:

File name:

爱接码平台客户端.exe

Verdict:

Malicious activity

Analysis date:

2026-09-01 03:03:53 UTC

Tags:

generic stealer

Link:

https://app.any.run/tasks/c21805b8-d863-4431-b125-557f21a1569a

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/83500/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a window

Creating a process from a recently created file

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file

Restart of the analyzed sample

Creating a process with a hidden window

Deleting a recently created file

Moving a file to the %temp% subdirectory

Connection attempt

Sending a custom TCP request

Creating a file in the %AppData% subdirectories

Launching a process

Forced system process termination

Sending an HTTP GET request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context anti-debug crypto embarcadero_delphi evasive fingerprint inno installer installer installer-heuristic packed reconnaissance

Link:

https://www.filescan.io/uploads/6a9646ce2cd6c6a8cc7f1244/reports/8af4120e-0a5e-47aa-8a15-46132a095101/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/2b371117fd3dc235ab72fa57397da7ed522ab65c665b2b0d62526ceafa3aa2c3

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-08-31T13:23:00Z UTC

Last seen:

2026-09-01T03:32:00Z UTC

Hits:

~10

Detections:

Trojan-Downloader.Agent.TCP.C&C HEUR:Trojan.Win32.SilverFox.gen

Link:

https://opentip.kaspersky.com/2b371117fd3dc235ab72fa57397da7ed522ab65c665b2b0d62526ceafa3aa2c3/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/3c0141a4-88f5-4bfc-bf86-db3d8bb3169b

Score:

82%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/2b371117fd3dc235ab72fa57397da7ed522ab65c665b2b0d62526ceafa3aa2c3

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/1813869bc6abb707250d89ae8b57ccb1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2b371117fd3dc235ab72fa57397da7ed522ab65c665b2b0d62526ceafa3aa2c3/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fm3rcf75hxbdlk3s7jlts7nh5vjcvns4mznswdlckjwov6r2ulbq._file

Result

Malware family:

danabot

Score:

10/10

Tags:

family:danabot banker discovery execution installer trojan

Link:

https://tria.ge/reports/260901-d2mlgagr2z/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Inno Setup is an open-source installation builder for Windows applications.

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Executes a VBScript file via the Windows Script Host.

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Downloads MZ/PE file

Family: Danabot

Unpacked files

SH256 hash:

2b371117fd3dc235ab72fa57397da7ed522ab65c665b2b0d62526ceafa3aa2c3

MD5 hash:

1813869bc6abb707250d89ae8b57ccb1

SHA1 hash:

a2d518da5c2c73c5f209cec920532d756e7d931f

Link:

https://www.unpac.me/results/101ba3d9-8be3-4054-a7ee-184e3fa9d95a/

SH256 hash:

7807de27ccf889a0186e4a98f7b1038f3ee5e8f95e57d453100409249ab61cc7

MD5 hash:

8fdf2796101f7e60420782dc01aac95b

SHA1 hash:

8aad9f51ea6143d41d04c729175a1d1bc160419f

Link:

https://www.unpac.me/results/101ba3d9-8be3-4054-a7ee-184e3fa9d95a/

SH256 hash:

a835607c2a48154c2e6b4e26d3dd72d8bb66d6b8d0f0d47ab9790dd6120ffd81

MD5 hash:

5a4c1c5f70ac49af147c4c0a5583edfd

SHA1 hash:

058b20eb0549c1ec200fada5f3d3e98221b44f63

Link:

https://www.unpac.me/results/101ba3d9-8be3-4054-a7ee-184e3fa9d95a/

SH256 hash:

05c2d2ed4549ed19cd6c72301e9e309cca8a018682d117d97caa6e0549bbe7a9

MD5 hash:

0fed1ee527c79c830c52897495c65208

SHA1 hash:

535a5baf59bea9d21f79d62b707fe0a7fe4a5052

Link:

https://www.unpac.me/results/101ba3d9-8be3-4054-a7ee-184e3fa9d95a/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2b371117fd3dc235ab72fa57397da7ed522ab65c665b2b0d62526ceafa3aa2c3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	Capability_Embedded_Lua Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects embedded Lua engines by looking for multiple Lua API symbols or env-var hooks

Rule name:	cobalt_strike_tmp01925d3f Create hunting rule
Author:	The DFIR Report
Description:	files - file ~tmp01925d3f.exe
Reference:	https://thedfirreport.com

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	Emotet Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Emotet in memory
Reference:	internal research

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA Create hunting rule
Author:	ditekSHen
Description:	Detects Windows executables referencing non-Windows User-Agents

Rule name:	malware_Emotet Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Emotet in memory
Reference:	internal research

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	malware_valleyrat_1ststage_strings Create hunting rule
Author:	Sekoia.io
Description:	Detects ValleyRat 1stage

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Sus_All_Windows_PE_Malware Create hunting rule
Author:	DiegoAnalytics
Description:	Detects Windows PE malware of all types, avoids non-executables like .html

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ValleyRAT

exe 2b371117fd3dc235ab72fa57397da7ed522ab65c665b2b0d62526ceafa3aa2c3

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/83500/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample