MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 605a60cbb8c3afebca792fe61b1791869ef25155c6493aca5f75038b2475baec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 15


Intelligence 15 IOCs 1 YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 605a60cbb8c3afebca792fe61b1791869ef25155c6493aca5f75038b2475baec
SHA3-384 hash: 1a118e8c0db409f8b4c7f3e7e89e2fa1ce0c5fa98d649682a8c38e6064662ed766bbeb6d4e8addbb60541597cf8e491b
SHA1 hash: 1620e7a502cb63e2ef24d20fb0a98692694e860b
MD5 hash: e4345886a1c6e1284f4befd3270fce4e
humanhash: pennsylvania-idaho-blossom-orange
File name:605a60cbb8c3afebca792fe61b1791869ef25155c6493.dll
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:1'997'312 bytes
First seen:2025-11-13 21:00:20 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 4a8e6415288e0a8a1bd172bef3582681 (1 x ValleyRAT)
ssdeep 49152:lHrNoK+AWgp12KBojxSQ2b2/9yPF78lSEM:lHrexAWG12KBojA7b2/9yPN8lSE
Threatray 713 similar samples on MalwareBazaar
TLSH T102956CA1BA60C477F16302F1854BBF38B2BDA3740F3A95C756D0DA2C6D2149247266EF
TrID 32.2% (.EXE) Win64 Executable (generic) (10522/11/4)
20.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
15.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
13.7% (.EXE) Win32 Executable (generic) (4504/4/1)
6.2% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter abuse_ch
Tags:dll RAT ValleyRAT


Avatar
abuse_ch
ValleyRAT C2:
192.238.177.237:6666

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
192.238.177.237:6666 https://threatfox.abuse.ch/ioc/1640995/

Intelligence

File Origin
# of uploads :
1
# of downloads :
101
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/38145/
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=691642d0434cd67b17c0f7aa
Tags:
shellcode injection dropper
Result
Verdict:
Clean
Maliciousness:

Behaviour
Sending a custom TCP request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug explorer fingerprint keylogger lolbin microsoft_visual_cc
Link:
https://www.filescan.io/uploads/691646f6219b4496562a2fb9/reports/141dc38c-1bb1-4782-b28a-2e3f0882ccf4/overview
Verdict:
Malicious
Labled as:
Tedy.Generic
Link:
https://www.hybrid-analysis.com/sample/605a60cbb8c3afebca792fe61b1791869ef25155c6493aca5f75038b2475baec
Verdict:
Malicious
File Type:
dll x32
First seen:
2025-11-13T17:33:00Z UTC
Last seen:
2025-11-14T00:52:00Z UTC
Hits:
~10
Detections:
Backdoor.Agent.TCP.C&C Trojan.Win32.Agent.sb HEUR:Trojan.Win32.Agent.gen Backdoor.Win32.Xkcp.a
Link:
https://opentip.kaspersky.com/605a60cbb8c3afebca792fe61b1791869ef25155c6493aca5f75038b2475baec/results?tab=lookup
Malware family:
Sysinternals
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/9946b1d1-4343-43b5-8210-849df5669222
Result
Threat name:
ValleyRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1813799
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to capture and log keystrokes
Contains functionality to detect sleep reduction / modifications
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Creates an autostart registry key pointing to binary in C:\Windows
Found malware configuration
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected ValleyRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1813799 Sample: 605a60cbb8c3afebca792fe61b1... Startdate: 13/11/2025 Architecture: WINDOWS Score: 100 46 Suricata IDS alerts for network traffic 2->46 48 Found malware configuration 2->48 50 Multi AV Scanner detection for submitted file 2->50 52 3 other signatures 2->52 7 loaddll32.exe 1 2->7         started        9 reg.exe 1 1 2->9         started        12 reg.exe 1 2->12         started        14 3 other processes 2->14 process3 signatures4 16 rundll32.exe 1 7->16         started        20 rundll32.exe 7->20         started        22 cmd.exe 1 7->22         started        24 conhost.exe 7->24         started        54 Creates an autostart registry key pointing to binary in C:\Windows 9->54 26 conhost.exe 9->26         started        28 conhost.exe 12->28         started        30 conhost.exe 14->30         started        process5 dnsIp6 34 192.238.177.237, 49690, 49691, 49692 LEASEWEB-USA-LAX-11US United States 16->34 36 Contains functionality to inject threads in other processes 16->36 38 Contains functionality to capture and log keystrokes 16->38 40 Contains functionality to inject code into remote processes 16->40 42 Contains functionality to detect sleep reduction / modifications 16->42 44 System process connects to network (likely due to code injection or exploit) 20->44 32 rundll32.exe 2 22->32         started        signatures7 process8
Score:
83%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/605a60cbb8c3afebca792fe61b1791869ef25155c6493aca5f75038b2475baec
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/e4345886a1c6e1284f4befd3270fce4e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/605a60cbb8c3afebca792fe61b1791869ef25155c6493aca5f75038b2475baec/
Verdict:
Malicious
Threat:
Family.VALLEYRAT_S2
Link:
https://tip.neiki.dev/file/605a60cbb8c3afebca792fe61b1791869ef25155c6493aca5f75038b2475baec
Threat name:
Win32.Trojan.ValleyRat
Create hunting rule
Status:
Malicious
First seen:
2025-11-13 20:42:59 UTC
File Type:
PE (Dll)
Extracted files:
37
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=mbngbs5yyox6xstzf7tbwf4rq2ppeukvyzetvss7oubywjdvxlwa._file
Verdict:
malicious
Label(s):
valleyrat
Create hunting rule
Similar samples:
09e0cd563e4bad791a14f4bbf4a87326009e71488b5dfb2f8176e749f619d549
ValleyRAT
38613e06fc7b73228e94980356ae8ab6c293c234daf13f78fb547eeb15d44eca
ValleyRAT
error
ValleyRAT
f1b411cb1dca35a911680b7ca2c31bb6ec893300780cecaf71a132c89eb74b37
ValleyRAT
fce7f7ad1d7b17e7106639ca23cc49d2cf642bcea024d8ba838f3f559c99e34c
ValleyRAT
+ 703 additional samples on MalwareBazaar
Result
Malware family:
valleyrat_s2
Create hunting rule
Score:
  10/10
Tags:
family:valleyrat_s2 backdoor discovery persistence
Link:
https://tria.ge/reports/251113-ztmgds1jgy/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Adds Run key to start application
Enumerates connected drives
Badlisted process makes network request
ValleyRat
Valleyrat_s2 family
Malware Config
C2 Extraction:
192.238.177.237:6666
192.238.177.237:8888
127.0.0.1:80
Unpacked files
SH256 hash:
605a60cbb8c3afebca792fe61b1791869ef25155c6493aca5f75038b2475baec
MD5 hash:
e4345886a1c6e1284f4befd3270fce4e
SHA1 hash:
1620e7a502cb63e2ef24d20fb0a98692694e860b
Link:
https://www.unpac.me/results/ba2dfb11-7a6c-442c-a179-9cd73b16fbb8/
Malware family:
ValleyRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/605a60cbb8c3/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/605a60cbb8c3afebca792fe61b1791869ef25155c6493aca5f75038b2475baec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Disable_Defender
Create hunting rule
Author:iam-py-test
Description:Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen
Rule name:GenericGh0st
Create hunting rule
Author:Still
Rule name:Gh0stKCP
Create hunting rule
Author:Netresec
Description:Detects HP-Socket ARQ and KCP implementations, which are used in Gh0stKCP. Forked from @stvemillertime's KCP catchall rule.
Reference:https://netresec.com/?b=259a5af
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Trojan_Winos_464b8a2e
Create hunting rule
Author:Elastic Security
Rule name:win_valley_rat_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.valley_rat.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/38145/

Comments