MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 70ab8b20d6ad347a3cc27f49d99987dd2ea4164f6e3d7cb2e113d0a68063a1c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ValleyRAT

Vendor detections: 6

Intelligence 6 IOCs YARA 3 File information Comments

SHA256 hash:	70ab8b20d6ad347a3cc27f49d99987dd2ea4164f6e3d7cb2e113d0a68063a1c0
SHA3-384 hash:	6d0dd2664cacdba3c6aa408f376fdc75e0dbb4ee670b0ea3f6048262faa5f422678570d00e5f7af62d7ab8140ccc7902
SHA1 hash:	17091b560967856d0614b549a2933d73267b77c1
MD5 hash:	9948d9e8d7807d275342edc0a777cf0a
humanhash:	finch-spring-foxtrot-apart
File name:	Nxonq1284_QUC.zip
Download:	download sample
Signature	ValleyRAT Create hunting rule
File size:	587'901 bytes
First seen:	2025-09-23 16:27:37 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	6144:vEi4dy0nxxeAjWFNTLcNZIPRZUOGPdVqcCtxc7Tx65xBl0EIfl89LbO8dmV5:04GMkbIPRZMdVRQxcv03Bp+lcdy5
TLSH	T1F6C43498B4401B43F1905B3B2E7EE1C9B79C33101A5C7891766B6E2EBE81BED64D44CB
Magika	zip
Reporter	GDHJDSYDH1
Tags:	backdoor dllHijack file-pumped SilverFox ValleyRAT zip

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 5 file(s), sorted by their relevance:

File name:	MSVCP140.dll
File size:	627'992 bytes
SHA256 hash:	99e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd
MD5 hash:	c1b066f9e3e2f3a6785161a8c7e0346a
MIME type:	application/x-dosexec
Signature	ValleyRAT

File name:	vcruntime140_1.dll
File size:	49'744 bytes
SHA256 hash:	6d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e
MD5 hash:	eb49c1d33b41eb49dfed58aafa9b9a8f
MIME type:	application/x-dosexec
Signature	ValleyRAT

File name:	VCRUNTIME140.dll
File size:	119'376 bytes
SHA256 hash:	a06c9ea4f815dac75d2c99684d433fbfc782010fae887837a03f085a29a217e8
MD5 hash:	e9b690fbe5c4b96871214379659dd928
MIME type:	application/x-dosexec
Signature	ValleyRAT

File name:	liblzma-5.dll
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	209'797'504 bytes
SHA256 hash:	b6f7aa2ae0b80c455d7febf55b5c4d7134164e5fd5af0bbac601cc858e3ac084
MD5 hash:	11a51b77e659e9706994f90ec5554f9b
De-pumped file size:	209'787'904 bytes (Vs. original size of 209'797'504 bytes)
De-pumped SHA256 hash:	03c3a76f49e945edf3109a17b08707f19a1203c6af4693ecc2f6aa02c3427abe
De-pumped MD5 hash:	61b9dfae3a4c2bc12cad6b44d27da55b
MIME type:	application/x-dosexec
Signature	ValleyRAT

File name:	habronemiasis.exe
File size:	67'560 bytes
SHA256 hash:	40c44d72233f3455abd7207a0ef531be7b4bb3e9f5fe84013db29d0655201092
MD5 hash:	a64c0797527d19fb2b2ccda92b172959
MIME type:	application/x-dosexec
Signature	ValleyRAT

Vendor Threat Intelligence

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=689c27289901157561b5b304

Tags:

n/a

Result

Verdict:

Malicious

File Type:

ZIP File - Malicious

Link:

https://app.docguard.net/70ab8b20d6ad347a3cc27f49d99987dd2ea4164f6e3d7cb2e113d0a68063a1c0/results/dashboard

Behaviour

SuspiciousEmbeddedObjects detected

Gathering data

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/70ab8b20d6ad347a3cc27f49d99987dd2ea4164f6e3d7cb2e113d0a68063a1c0

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/70ab8b20d6ad347a3cc27f49d99987dd2ea4164f6e3d7cb2e113d0a68063a1c0

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Clean

File Type:

zip

Link:

https://opentip.kaspersky.com/70ab8b20d6ad347a3cc27f49d99987dd2ea4164f6e3d7cb2e113d0a68063a1c0/results?tab=lookup

Score:

Verdict:

Benign

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PK_PUMP_AND_DUMP Create hunting rule
Author:	Will Metcalf @node5
Description:	Walks Zip Central Directory filename entries looking for abused extension then checks for a file that's at least 25M and then check to see how much uncompressed size is vs compressed size