MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 36c3dc54b916de228ece4cff973790a2e1fa46b3bb6ce2f6660087d6dabe3ad4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 23 File information Comments

SHA256 hash:	36c3dc54b916de228ece4cff973790a2e1fa46b3bb6ce2f6660087d6dabe3ad4
SHA3-384 hash:	76239e9a47d6ee326a870d8ed91ab94322a589bdfd19f921ca733e39b6c8b5214441abaac14af9c506f0f25b3cb67293
SHA1 hash:	5d31cb99880fc9d8637870f9ea153e70ff9a378f
MD5 hash:	bc0bd602efb363a4b218f1a267f1eb6e
humanhash:	cup-idaho-crazy-rugby
File name:	Kugo.zip
Download:	download sample
File size:	4'222'006 bytes
First seen:	2026-06-26 14:41:29 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	98304:1pIAM7DFQkFSt63kLzzyFmmWnj7Gtpxorcj6Tq4xt8EYW9a:XI73FQdpXjmWnAu+EXa
TLSH	T1BD163382AEC5D40E116FBFB8C97C8458B1B64FE3F8246FD2B5D8AC4359652C0829F54E
TrID	60.0% (.WMZ) Windows Media Player skin (6000/1/1) 40.0% (.ZIP) ZIP compressed archive (4000/1)
Magika	zip
Reporter	GDHJDSYDH1
Tags:	backdoor dllHijack SilverFox ValleyRAT zip

GDHJDSYDH1

C2:18.142.28.6 (cehoirfg.work)
Dropped by: https://www.virustotal.com/gui/file/f885d5c0783846a9e0ae091e50b4f866b5890b53be5f0ac18fcc1d6e10d0576d

Intelligence

File Origin

# of uploads :

# of downloads :

109

Origin country :

File Archive Information

This file archive contains 4 file(s), sorted by their relevance:

File name:	HWSignature.dll
File size:	14'336 bytes
SHA256 hash:	2ba4a96cbf7dcb0230d0ff939ae5f257fd915bd780dddfbf0ec262842224c402
MD5 hash:	881e29fae43333f2e9bb8e694d3dc66f
MIME type:	application/x-dosexec

File name:	sgfeedbackhelper.exe
File size:	3'292'544 bytes
SHA256 hash:	b2230f1e1e4fe538eb3c513e6612d82453e708ac94373b155624a656620f1bbc
MD5 hash:	be9d0fd7235fd9c760acabe2b26502ff
MIME type:	application/x-dosexec

File name:	ImageMagik.dll
File size:	6'155'648 bytes
SHA256 hash:	b7934fd46c2fef0ee93dcb33d03a9ceb7a560670f1666fa4ef0e66d04f7fb396
MD5 hash:	cdfdf1939aa7a065aa9f3cd07a99acde
MIME type:	application/x-dosexec

File name:	msedge.exe
File size:	2'371 bytes
SHA256 hash:	b868cb9d615807d709678400bc5d4261a9c2a2213dcbaceaaa3be428e8b90236
MD5 hash:	701acbbd8a3a9ed01b2f0ab9ce1458c5
MIME type:	application/octet-stream

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/3963d1b2-3c67-40ed-8826-8a378fa14daf/

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a3e8fdc86bc95245bf9b967

Tags:

n/a

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

anti-debug packed

Link:

https://www.filescan.io/uploads/6a3e8fd667b48f79617c7115/reports/21f9ce75-d7e7-4523-b3ab-12f948d3c590/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/36c3dc54b916de228ece4cff973790a2e1fa46b3bb6ce2f6660087d6dabe3ad4

Verdict:

Clean

File Type:

zip

Link:

https://opentip.kaspersky.com/36c3dc54b916de228ece4cff973790a2e1fa46b3bb6ce2f6660087d6dabe3ad4/results?tab=lookup

Score:

36%

Verdict:

Susipicious

File Type:

Result

Malware family:

valleyrat_s2

Score:

10/10

Tags:

family:valleyrat_s2 adware backdoor discovery execution persistence ransomware spyware

Link:

https://tria.ge/reports/260626-tnstbsdt6l/

Behaviour

Checks SCSI registry key(s)

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Checks installed software on the system

Enumerates connected drives

Checks computer location settings

Badlisted process makes network request

Boot or Logon Autostart Execution: Active Setup

Command and Scripting Interpreter: PowerShell

Detects ValleyRAT payload

Family: ValleyRat

Malware Config

C2 Extraction:

cehoirfg.work:449
127.0.0.1:80

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.43

Link:

https://yomi.yoroi.company/submissions/36c3dc54b916de228ece4cff973790a2e1fa46b3bb6ce2f6660087d6dabe3ad4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	Glasses Create hunting rule
Author:	Seth Hardy
Description:	Glasses family

Rule name:	GlassesCode Create hunting rule
Author:	Seth Hardy
Description:	Glasses code features

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	HUNTING_SUSP_TLS_SECTION Create hunting rule
Author:	chaosphere
Description:	Detect PE files with .tls section that can be used for anti-debugging
Reference:	Practical Malware Analysis - Chapter 16

Rule name:	Indicator_MiniDumpWriteDump Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Suspicious_Process Create hunting rule
Author:	Security Research Team
Description:	Suspicious process creation

Rule name:	SUSP_ZIP_Smuggling_Jun01 Create hunting rule
Author:	delivr.to
Description:	ZIP archives with data smuggled between last file record and the central directory.
Reference:	https://github.com/Octoberfest7/zip_smuggling/

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.