MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c547f7a7e7964a03945cef9bd53e792256e2beb24e15be780714ae349c8a81b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 12


Intelligence 12 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6c547f7a7e7964a03945cef9bd53e792256e2beb24e15be780714ae349c8a81b
SHA3-384 hash: 4a2c45cb176bc88aff0a792bbb2dd801291fb4f201124c04a7a3645b8ec0f962cfe0cc5c520f81d4e6d0f81ff046046b
SHA1 hash: a13dedaceed797a4ee8b399c7db20e88535ab6cc
MD5 hash: a994f2b3b899758bddf5f35e407a694d
humanhash: zebra-spaghetti-west-jig
File name:6C547F7A7E7964A03945CEF9BD53E792256E2BEB24E15BE780714AE349C8A81B.exe
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:70'322'189 bytes
First seen:2024-12-22 08:30:36 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash b5a014d7eeb4c2042897567e1288a095 (21 x HijackLoader, 14 x ValleyRAT, 12 x LummaStealer)
ssdeep 1572864:T6GU+TLvNqXhlk5jR/7ouTb4CYw1UnxcpMP0s/gH6iERvUUzVwDVuPOtW:Tauehlk/k8ww1UnqpMPHKAUU+gOY
TLSH T1C8F73310E3A057B8F873007D5426CF9BE205ABA757D261637608073B31ADEEFFA065A5
TrID 38.7% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
24.6% (.EXE) Win64 Executable (generic) (10522/11/4)
11.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
10.5% (.EXE) Win32 Executable (generic) (4504/4/1)
4.7% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
File icon (PE):PE icon
dhash icon 848c5454baf47474 (2'088 x Adware.Neoreklami, 101 x RedLineStealer, 33 x DiamondFox)
Reporter Panda
Tags:exe FakeApp SilverFox trojan ValleyRAT winos

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
43.250.172.42:17091 https://threatfox.abuse.ch/ioc/1359161/

Intelligence

File Origin
# of uploads :
1
# of downloads :
513
Origin country :
MY MY
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
6C547F7A7E7964A03945CEF9BD53E792256E2BEB24E15BE780714AE349C8A81B.exe
Verdict:
Malicious activity
Analysis date:
2024-12-22 08:32:12 UTC
Tags:
silverfox backdoor
Link:
https://app.any.run/tasks/29bf2790-5564-4b33-b1f3-267c29e892aa

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6767ce4f8a4d48ee35fe03b3
Tags:
emotet shell virus sage
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Creating a file
Сreating synchronization primitives
Running batch commands
Creating a process with a hidden window
Creating a process from a recently created file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context fingerprint installer microsoft_visual_cc overlay packed packer_detected
Link:
https://www.filescan.io/uploads/6767ce49f7937d37eb50ef08/reports/3cda5e91-aa40-4635-bcd8-0ecf8e270eb4/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/6c547f7a7e7964a03945cef9bd53e792256e2beb24e15be780714ae349c8a81b
Result
Verdict:
MALICIOUS
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad.troj
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1579418
Signature
Bypasses PowerShell execution policy
Connects to many ports of the same IP (likely port scanning)
Loading BitLocker PowerShell Module
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Execution from Suspicious Folder
Sigma detected: Parent in Public Folder Suspicious Process
Sigma detected: Suspicious Program Location with Network Connections
Suricata IDS alerts for network traffic
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1579418 Sample: Fqae7BLq4m.exe Startdate: 22/12/2024 Architecture: WINDOWS Score: 88 60 Suricata IDS alerts for network traffic 2->60 62 Multi AV Scanner detection for dropped file 2->62 64 Multi AV Scanner detection for submitted file 2->64 66 4 other signatures 2->66 9 Fqae7BLq4m.exe 9 2->9         started        process3 file4 50 C:\Users\Public\...\Firefox Setup 132.0.2.exe, PE32 9->50 dropped 52 C:\Users\Public\Bilite\Axialis\libcurl.dll, PE32 9->52 dropped 54 C:\Users\Public\Bilite\...\RuntimeBrokers.exe, PE32 9->54 dropped 12 cmd.exe 1 9->12         started        process5 signatures6 68 Bypasses PowerShell execution policy 12->68 15 RuntimeBrokers.exe 3 18 12->15         started        19 conhost.exe 12->19         started        process7 dnsIp8 56 43.250.172.42, 17091, 17092, 18852 VPSQUANUS China 15->56 44 C:\Users\user\AppData\Local\Temp\backup.exe, PE32 15->44 dropped 46 C:\Users\user\AppData\Local\Temp\backup.dll, PE32 15->46 dropped 48 C:\Users\user\AppData\Local\updated.ps1, ASCII 15->48 dropped 21 cmd.exe 1 15->21         started        23 cmd.exe 1 15->23         started        25 cmd.exe 1 15->25         started        file9 process10 process11 27 conhost.exe 21->27         started        29 tasklist.exe 1 21->29         started        31 findstr.exe 1 21->31         started        42 35 other processes 21->42 33 powershell.exe 1 23 23->33         started        36 conhost.exe 23->36         started        38 powershell.exe 39 25->38         started        40 conhost.exe 25->40         started        signatures12 58 Loading BitLocker PowerShell Module 38->58
Score:
96%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6c547f7a7e7964a03945cef9bd53e792256e2beb24e15be780714ae349c8a81b
Gathering data
Threat name:
Win32.Trojan.DllHijack
Create hunting rule
Status:
Malicious
First seen:
2024-12-21 21:44:22 UTC
File Type:
PE (Exe)
Extracted files:
14482
AV detection:
20 of 38 (52.63%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nrkh66t6pfskaokfz3432u7hsisw4k7letqvxz4aoffogsoivanq._file
Verdict:
malicious
Label(s):
winos
Create hunting rule
Similar samples:
error
ValleyRAT
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery execution
Link:
https://tria.ge/reports/241222-kep7ea1pap/
Behaviour
Delays execution with timeout.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Enumerates processes with tasklist
Command and Scripting Interpreter: PowerShell
Enumerates connected drives
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Verdict:
Malicious
Tags:
Win.Malware.Lazy-10039964-0
YARA:
n/a
Link:
https://app.threat.zone/submission/0c5e37da-b15b-4aae-b597-07fd6797fcf0
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
CHECK_TRUST_INFORequires Elevated Execution (level:requireAdministrator)high
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
ole32.dll::CreateStreamOnHGlobal
SHELL_APIManipulates System ShellSHELL32.dll::ShellExecuteExW
SHELL32.dll::ShellExecuteW
SHELL32.dll::SHGetFileInfoW
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetDriveTypeW
KERNEL32.dll::GetStartupInfoA
KERNEL32.dll::GetDiskFreeSpaceExW
KERNEL32.dll::GetCommandLineW
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateDirectoryW
KERNEL32.dll::CreateFileW
KERNEL32.dll::DeleteFileW
KERNEL32.dll::GetSystemDirectoryW
KERNEL32.dll::GetFileAttributesW
KERNEL32.dll::FindFirstFileW
WIN_USER_APIPerforms GUI ActionsUSER32.dll::CreateWindowExW

Comments