MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35d221d282a772437c17e374f666dab1423d7af7377f9300baf3612db23874e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 14


Intelligence 14 IOCs 1 YARA 13 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 35d221d282a772437c17e374f666dab1423d7af7377f9300baf3612db23874e4
SHA3-384 hash: 52220aedeb7aca39392bc39c71352cf7d9b96cc479bf09c29a9c5d1c56553d2db5fca31bcf0328757eb1a5a6df8c4f63
SHA1 hash: 4d657a1960c0ec3ec74ebfb6d14fd37c8143b077
MD5 hash: df46f4c3f25701e29405a5686e485a43
humanhash: ack-april-cold-carbon
File name:HUoRONG.msi
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:2'152'960 bytes
First seen:2025-12-20 14:28:50 UTC
Last seen:2025-12-20 18:52:57 UTC
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 49152:wkP0ohlj9szAlopTyWD5L6D5jkakEv53rgNa8h6dpuH8:woSTy8wkf880XG8
TLSH T16CA5AD21B287C036D16E0177E968EF5E1938BE730B3145D777E83D6E49B08C2A279B06
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter Ling
Tags:msi signed Trojan:Script/Wacatac.H!ml ValleyRAT wacatac

Code Signing Certificate

Organisation:泉州浩英科技有限公司
Issuer:Certum Extended Validation Code Signing 2021 CA
Algorithm:sha256WithRSAEncryption
Valid from:2025-12-19T12:47:17Z
Valid to:2026-12-19T12:47:16Z
Serial number: 7368e399e2ed75794afa87cb933df778
Intelligence: 3 malware samples on MalwareBazaar are signed with this code signing certificate
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: 807e2f24aab5da07153a293d74104e8ddf00656ac2ae5019fd452f59d7ed11a7
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
103.112.99.226:443 https://threatfox.abuse.ch/ioc/1683835/

Intelligence

File Origin
# of uploads :
2
# of downloads :
66
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
MSI
Details
MSI
an embedded setup program or component
Link:
https://research.acce.ciphertechsolutions.com/results/18611f5c-692d-4513-b6ab-8377eeddcbb5/
Detection:
WinosStager
Create hunting rule
Link:
https://www.capesandbox.com/analysis/45594/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6946b2b8ee899ae4567f1b76
Tags:
n/a
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug base64 cmd expired-cert farfli fingerprint installer lolbin msiexec packed short-lived-cert signed wix
Link:
https://www.filescan.io/uploads/6946b2b63f8fdbf8e94cfeaf/reports/bd359067-2f26-4d64-af39-cc172d802a12/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/35d221d282a772437c17e374f666dab1423d7af7377f9300baf3612db23874e4
Result
Verdict:
SUSPICIOUS
Link:
https://labs.inquest.net/dfi/sha256/35d221d282a772437c17e374f666dab1423d7af7377f9300baf3612db23874e4
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
File Type:
msi
First seen:
2025-12-20T09:54:00Z UTC
Last seen:
2025-12-22T05:40:00Z UTC
Hits:
~100
Detections:
VHO:Backdoor.Win32.Agent.gen Backdoor.Win32.Agent.sb HEUR:Backdoor.Win32.Farfli.gen
Link:
https://opentip.kaspersky.com/35d221d282a772437c17e374f666dab1423d7af7377f9300baf3612db23874e4/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/35d221d282a772437c17e374f666dab1423d7af7377f9300baf3612db23874e4
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
CAB:COMPRESSION:MSZIP Executable Office Document PDB Path PE (Portable Executable) PE File Layout SVG
Link:
https://app.malva.re/file/df46f4c3f25701e29405a5686e485a43
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/35d221d282a772437c17e374f666dab1423d7af7377f9300baf3612db23874e4/
Verdict:
Malicious
Threat:
Backdoor.Win32.Farfli
Link:
https://tip.neiki.dev/file/35d221d282a772437c17e374f666dab1423d7af7377f9300baf3612db23874e4
Threat name:
Win32.Backdoor.Farfli
Create hunting rule
Status:
Malicious
First seen:
2025-12-20 14:29:11 UTC
File Type:
Binary (Archive)
Extracted files:
46
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gxjcduucu5zeg7ax4n2pmzw2wfbd26xxg57zgaf26nqs3mryotsa._file
Verdict:
malicious
Label(s):
konni
Create hunting rule
valleyrat
Create hunting rule
Similar samples:
error
ValleyRAT
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery persistence privilege_escalation ransomware
Link:
https://tria.ge/reports/251223-nwjmqswlf1/
Behaviour
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
Drops file in Windows directory
Badlisted process makes network request
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/a89e5d66-d58e-468c-b88f-f38284033ff0
Malware family:
ValleyRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/35d221d282a7/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/35d221d282a772437c17e374f666dab1423d7af7377f9300baf3612db23874e4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_MSI_LATAM_Banker_From_LatAm
Create hunting rule
Rule name:GenericGh0st
Create hunting rule
Author:Still
Rule name:Gh0stKCP
Create hunting rule
Author:Netresec
Description:Detects HP-Socket ARQ and KCP implementations, which are used in Gh0stKCP. Forked from @stvemillertime's KCP catchall rule.
Reference:https://netresec.com/?b=259a5af
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:Indicator_MiniDumpWriteDump
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:ValleyRAT
Create hunting rule
Author:NDA0E
Description:Detects ValleyRAT
Rule name:Windows_Generic_Threat_4b0b73ce
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Winos_464b8a2e
Create hunting rule
Author:Elastic Security
Rule name:win_valley_rat_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.valley_rat.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ValleyRAT

Microsoft Software Installer (MSI) msi 35d221d282a772437c17e374f666dab1423d7af7377f9300baf3612db23874e4

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/45594/

Comments