MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c5354f43b9d8bdf26b613b947bfac4e6598bcdad3063449551017a5c0939fa1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ValleyRAT

Vendor detections: 13

Intelligence 13 IOCs 1 YARA 9 File information Comments

SHA256 hash:	3c5354f43b9d8bdf26b613b947bfac4e6598bcdad3063449551017a5c0939fa1
SHA3-384 hash:	db8ef7e4fb23246d050c0c842ef4bc42ec4741fe0188dded8dcbe89a69d76dac198208c44e2281364fe3fac436009232
SHA1 hash:	9f424bd5e0d55eee775a5d7c331dc04f05c559f9
MD5 hash:	f16ab22fc724b6617abf545bbd79434c
humanhash:	eleven-cardinal-diet-nevada
File name:	tt_setup.exe
Download:	download sample
Signature	ValleyRAT Create hunting rule
File size:	52'396'419 bytes
First seen:	2025-08-21 08:05:24 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	40ab50289f7ef5fae60801f88d4541fc (59 x ValleyRAT, 49 x Gh0stRAT, 41 x OffLoader)
ssdeep	1572864:/PB59p5Kx2CbKsmuerrYsQ72iTk91Rjp6j:/Z59X6btE4s+20Wjpy
Threatray	569 similar samples on MalwareBazaar
TLSH	T1D1B7332776CBF139F8A99B370276E454D0FB2B60A4176D96CBD080A8CF741640D7E36A
TrID	60.0% (.EXE) Inno Setup installer (107240/4/30) 23.2% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 5.8% (.EXE) Win64 Executable (generic) (10522/11/4) 3.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 2.5% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	e09a676060678ee0 (14 x AsyncRAT, 5 x ValleyRAT, 4 x Formbook)
Reporter	GDHJDSYDH1
Tags:	backdoor dropper exe SilverFox ValleyRAT winos

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
206.238.40.106:8880	https://threatfox.abuse.ch/ioc/1571998/

Intelligence

File Origin

# of uploads :

# of downloads :

122

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

tt_setup.exe

Verdict:

Malicious activity

Analysis date:

2025-08-21 07:57:17 UTC

Tags:

inno installer delphi stealer valleyrat winos rat silverfox

Link:

https://app.any.run/tasks/4d76c30e-5936-4a4f-8b0c-4c1d7634f0fe

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Clean

Score:

N/A%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68a6d3698fd55a79c529ab67

Tags:

n/a

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a window

Creating a process from a recently created file

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file

Moving a recently created file

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Creating a process with a hidden window

Delayed reading of the file

Creating a service

Launching a service

Loading a system driver

Launching a process

DNS request

Connection attempt

Enabling autorun for a service

Unauthorized injection to a system process

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug embarcadero_delphi fingerprint installer overlay overlay packed threat zero

Link:

https://www.filescan.io/uploads/68a6d365abfbaec318274782/reports/03871469-cf87-4b41-9ca9-64ffd609a9f2/overview

Verdict:

Malicious

Labled as:

VHO:TrojanDrop.Convagent.gen

Link:

https://www.hybrid-analysis.com/sample/3c5354f43b9d8bdf26b613b947bfac4e6598bcdad3063449551017a5c0939fa1

Score:

65%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/3c5354f43b9d8bdf26b613b947bfac4e6598bcdad3063449551017a5c0939fa1

Gathering data

Verdict:

Malicious

Threat:

Family.VALLEYRAT

Link:

https://tip.neiki.dev/file/3c5354f43b9d8bdf26b613b947bfac4e6598bcdad3063449551017a5c0939fa1

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hrjvj5b3twf56jvwco4upp5mjzszrpg22mddiskvcal2lqett6qq._file

Verdict:

malicious

Label(s):

winos

Result

Malware family:

valleyrat_s2

Score:

10/10

Tags:

family:valleyrat_s2 backdoor defense_evasion discovery execution exploit persistence

Link:

https://tria.ge/reports/250821-jy9vgs1qs8/

Behaviour

Enumerates system info in registry

Modifies registry class

Runs ping.exe

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Launches sc.exe

Suspicious use of SetThreadContext

Checks installed software on the system

Drops desktop.ini file(s)

Enumerates connected drives

Indicator Removal: File Deletion

Executes dropped EXE

Loads dropped DLL

Modifies file permissions

Command and Scripting Interpreter: PowerShell

Creates new service(s)

Modifies trusted root certificate store through registry

Possible privilege escalation attempt

Sets service image path in registry

Stops running service(s)

ValleyRat

Valleyrat_s2 family

Malware Config

C2 Extraction:

keepmasterr.com:8880
127.0.0.1:80

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/32eec441-f168-4c2e-9db4-aebac1e6e7cd

Malware family:

Mimikatz

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/3c5354f43b9d/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3c5354f43b9d8bdf26b613b947bfac4e6598bcdad3063449551017a5c0939fa1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	botnet_plaintext_c2 Create hunting rule
Author:	cip
Description:	Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.

Rule name:	CP_AllMal_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	HUNTING_SUSP_TLS_SECTION Create hunting rule
Author:	chaosphere
Description:	Detect PE files with .tls section that can be used for anti-debugging
Reference:	Practical Malware Analysis - Chapter 16

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)