🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ac502cc0835ae08f4773be06af9ca53a2e23a9b7630cf42eedd9074e9e6a803. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ac502cc0835ae08f4773be06af9ca53a2e23a9b7630cf42eedd9074e9e6a803
SHA3-384 hash: dd4531854fd83f2a58cca88aac38122d7a09800af351f772f69964ef621c7b3dd902c7245cacfe8796f9a48480a67391
SHA1 hash: 21da9b3b16d8219c75ed3f244ec628d949a7fcf4
MD5 hash: e13df3ed7b1fc2c4f908eba0083d3082
humanhash: skylark-gee-colorado-kitten
File name:剪映电脑版【免VIP版】.exe
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:6'396'379 bytes
First seen:2026-10-21 20:13:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 573bb7b41bc641bd95c0f5eec13c233b (67 x GuLoader, 33 x AgentTesla, 31 x RemcosRAT)
ssdeep 196608:sA5OIGgKZT2ELEgMwXBE97/QHrlZ6m+99DIIp2:sb3ECEtwXyloP6m+99lw
TLSH T14556338379009288E1B25A739275D4B1462B3D77CE61EE19F0F4BD173BB21E5212F93A
TrID 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.5% (.EXE) Win64 Executable (generic) (6522/11/2)
8.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 96b2330f4d332b0c (1 x ValleyRAT)
Reporter Ling
Tags:exe SilverFox ValleyRAT


Avatar
CNGaoLing
SilverFox
IOC (Domain msa.opcomat.com) (IP 177.5.72.62:80)

Intelligence

File Origin
# of uploads :
1
# of downloads :
206
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
NSIS
Details
Link:
https://research.acce.ciphertechsolutions.com/results/54cb966d-5b1e-4b22-b369-b83d48cb3c9d/
Malware family:
n/a
ID:
1
File name:
剪映电脑版【免VIP版】.exe
Verdict:
Malicious activity
Analysis date:
2026-10-21 19:50:44 UTC
Tags:
donutloader loader
Link:
https://app.any.run/tasks/746ae435-d5d9-428a-a1ed-2c597deb2f07

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/93723/
Detection(s):
Sanesecurity.Malware.28885.BadCo.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad91ce55a22ac805bd91f5f
Tags:
shellcode dropper blic
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the Program Files subdirectories
Creating a file in the %AppData% subdirectories
Creating a process from a recently created file
Creating a file in the %temp% subdirectories
Creating synchronization primitives
Creating a window
Searching for synchronization primitives
Creating a file
Delayed reading of the file
Moving a recently created file
Connection attempt
DNS request
Sending a custom TCP request
Creating a process with a hidden window
Deleting a recently created file
Gathering data
Verdict:
Malicious
Labled as:
Malware_60.0
Link:
https://www.hybrid-analysis.com/sample/5ac502cc0835ae08f4773be06af9ca53a2e23a9b7630cf42eedd9074e9e6a803
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-19T03:08:00Z UTC
Last seen:
2026-10-19T03:42:00Z UTC
Hits:
~10
Detections:
VHO:Trojan.Win32.Loader.gen Trojan.Win32.Shellcode.sb Trojan.Win32.Loader.tsq Trojan.Win32.Autorun.sb Trojan.Win32.Agent.sb Trojan.Multi.Agent.au HEUR:Trojan.Win64.DllHijack.gen
Link:
https://opentip.kaspersky.com/5ac502cc0835ae08f4773be06af9ca53a2e23a9b7630cf42eedd9074e9e6a803/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/6a193d49-668b-4aa4-b1f7-2f730fc04e28
Score:
94%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5ac502cc0835ae08f4773be06af9ca53a2e23a9b7630cf42eedd9074e9e6a803
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable NSIS Installer PDB Path PE (Portable Executable) PE File Layout PE Memory-Mapped (Dump) T1059.007 Win 32 Exe x86
Link:
https://app.malva.re/file/e13df3ed7b1fc2c4f908eba0083d3082
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5ac502cc0835ae08f4773be06af9ca53a2e23a9b7630cf42eedd9074e9e6a803/
Threat name:
Win32.Exploit.DonutMarte
Create hunting rule
Status:
Malicious
First seen:
2026-10-21 20:14:27 UTC
File Type:
PE (Exe)
Extracted files:
59
AV detection:
21 of 38 (55.26%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=llcqftaigwxar5dxhpqgv6okkoroeou3oyym6qxo3wihj2pgvabq._file
Verdict:
malicious
Label(s):
DonutLoader
Create hunting rule
GentleKiller
Create hunting rule
Link:
https://reports.threatray.com/2d12fa66-ef84-4d27-9368-878a9750ad4b
Result
Malware family:
donutloader
Create hunting rule
Score:
  10/10
Tags:
family:donutloader defense_evasion discovery installer loader persistence ransomware
Link:
https://tria.ge/reports/261021-y1mv3afx2z/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Inno Setup is an open-source installation builder for Windows applications.
Direct Volume Access: Opens a physical disk for reading
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Checks installed software on the system
Executes dropped EXE
Loads dropped DLL
Detects DonutLoader
Family: DonutLoader
Unpacked files
SH256 hash:
5ac502cc0835ae08f4773be06af9ca53a2e23a9b7630cf42eedd9074e9e6a803
MD5 hash:
e13df3ed7b1fc2c4f908eba0083d3082
SHA1 hash:
21da9b3b16d8219c75ed3f244ec628d949a7fcf4
Link:
https://www.unpac.me/results/f8ac6f53-f692-4575-bb32-79095ac89c4a/
SH256 hash:
2e9f132b9a5fdeb86b865403e49f1322bb9528447d91bf1a60601f0732dcd4ec
MD5 hash:
2253e2efee1c18ea38b77a67227b0916
SHA1 hash:
467819f0f51046a34b32c28ff8ac4d7ff6139b59
Link:
https://www.unpac.me/results/f8ac6f53-f692-4575-bb32-79095ac89c4a/
SH256 hash:
f3e84dfbfc2a88adbf9582eb6c54b49a7f48a7880eaaca9530c1be2cd7cdac8e
MD5 hash:
811bf000ea455efb5d65430a6b510c22
SHA1 hash:
739a83c4868b7c058d089e10cfeed178e63fb687
Link:
https://www.unpac.me/results/f8ac6f53-f692-4575-bb32-79095ac89c4a/
SH256 hash:
3fc7f07ec11ec9d6d751308a10642709cc7c8603f5f666808c3bbb5ac171c8ab
MD5 hash:
02effcf237be36f076a63160ba8a31c3
SHA1 hash:
d2a78bda55275cb5b897b834cfac0a85fbb46b6d
Link:
https://www.unpac.me/results/f8ac6f53-f692-4575-bb32-79095ac89c4a/
SH256 hash:
50f735ab8f3473423e6873d628150bbc0777be7b4f6405247cddf22bb00fb6be
MD5 hash:
33ec04738007e665059cf40bc0f0c22b
SHA1 hash:
4196759a922e333d9b17bda5369f14c33cd5e3bc
Link:
https://www.unpac.me/results/f8ac6f53-f692-4575-bb32-79095ac89c4a/
SH256 hash:
b2bf594ea97043fb54a12da3e74dabf49eb5510530b11b4d79ed2c8e2e1b54c7
MD5 hash:
efd44b2dcd2abe9cd9e8c30291a0a032
SHA1 hash:
af2a4f1452ba3656c9eac0db6e0f9a23117133db
Link:
https://www.unpac.me/results/f8ac6f53-f692-4575-bb32-79095ac89c4a/
Malware family:
ValleyRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5ac502cc0835/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5ac502cc0835ae08f4773be06af9ca53a2e23a9b7630cf42eedd9074e9e6a803

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:NSIS
Create hunting rule
Author:kevoreilly
Description:NSIS Integrity Check function
Rule name:Win_Clipboard_Clipper_Thengavar
Create hunting rule
Author:Thengavar
Description:Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ValleyRAT

Executable exe 5ac502cc0835ae08f4773be06af9ca53a2e23a9b7630cf42eedd9074e9e6a803

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/93723/

Comments