MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69e3a2f16a3726c20d519b41fed01a0170485b54683f5fda89c76e248b185cab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 7


Intelligence 7 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 69e3a2f16a3726c20d519b41fed01a0170485b54683f5fda89c76e248b185cab
SHA3-384 hash: 59d816736fc3729cb93afc7101ce6607662ac7510b8cc429d6bdb9497e65f9e4e0cd94d5be817997b6da6ded9e9c3f46
SHA1 hash: 5f875b453b2ba9875bc1b5bfc7a8672aeae8eee5
MD5 hash: 9a3ba9144b1e80046f8bf19b498745de
humanhash: hydrogen-princess-uncle-hydrogen
File name:wangwang_win_online2.4.1.exe
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:82'545'061 bytes
First seen:2025-06-25 00:12:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 40ab50289f7ef5fae60801f88d4541fc (59 x ValleyRAT, 49 x Gh0stRAT, 41 x OffLoader)
ssdeep 1572864:xv5+lPkToPY4EiWnSF1eZYohu0caVqg6gSgfHD+Xr+9rKvh:xv5bTog4VESGZug8g6SCerKp
TLSH T163083303B3C7943EE06DDB3651B3F35886FB6DA59921792A52E5A9ECCF395000C2D60B
TrID 60.0% (.EXE) Inno Setup installer (107240/4/30)
23.2% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
5.8% (.EXE) Win64 Executable (generic) (10522/11/4)
3.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
2.5% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 32323032b2b273e8 (3 x ValleyRAT, 1 x Nitol)
Reporter GDHJDSYDH1
Tags:backdoor dropper exe SilverFox ValleyRAT


Avatar
GDHJDSYDH1
C2: 8.217.85.20:27955
Family: ValleyRat.C2
Reference: https://hunting.abuse.ch/hunt/8.217.85.20/#sandnet

Intelligence

File Origin
# of uploads :
1
# of downloads :
822
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
wangwang_win_online2.4.1.exe
Verdict:
No threats detected
Analysis date:
2025-06-25 00:10:03 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/e4fbd1cd-1b41-4915-9068-b2e22d0fe632

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=685b3f49b06783b9ebd725ac
Tags:
shellcode dropper blic
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Creating a file
Launching the default Windows debugger (dwwin.exe)
Enabling autorun with the shell\open\command registry branches
Verdict:
Malicious
Labled as:
VHO:TrojanDrop.Convagent.gen
Link:
https://www.hybrid-analysis.com/sample/69e3a2f16a3726c20d519b41fed01a0170485b54683f5fda89c76e248b185cab
Score:
60%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/69e3a2f16a3726c20d519b41fed01a0170485b54683f5fda89c76e248b185cab
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nhr2f4lkg4tmedkrtna75ua2afyeqw2una7v7wujy5xcjcyylsvq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution
Link:
https://tria.ge/reports/250625-ah6cpabr2x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Executes dropped EXE
Loads dropped DLL
Command and Scripting Interpreter: PowerShell
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/2bd9b3ee-a6c2-45b8-9e53-6e392a7e4a94
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:SUSP_XORed_MSDOS_Stub_Message
Create hunting rule
Author:Florian Roth
Description:Detects suspicious XORed MSDOS stub message
Reference:https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings
Rule name:SUSP_XORed_URL_In_EXE
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:SUSP_XORed_URL_in_EXE_RID2E46
Create hunting rule
Author:Florian Roth
Description:Detects an XORed URL in an executable
Reference:https://twitter.com/stvemillertime/status/1237035794973560834
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ValleyRAT

Executable exe 69e3a2f16a3726c20d519b41fed01a0170485b54683f5fda89c76e248b185cab

(this sample)

  
Link
https://tria.ge/250625-adghrs1lx5/behavioral2
  
Delivery method
Distributed via web download

Comments