MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7688c08ee19cd46ad76d0a27bcd4b5f596a9732eac66afb7f877f197c1886343. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ValleyRAT

Vendor detections: 7

Intelligence 7 IOCs YARA 7 File information Comments

SHA256 hash:	7688c08ee19cd46ad76d0a27bcd4b5f596a9732eac66afb7f877f197c1886343
SHA3-384 hash:	e50cb591dabe9922a860131e61f66415566542df9ae906dc223d654424b90e467b2ec796db2c0baa782b82d7a0bb2783
SHA1 hash:	ca26f28ab5f3644e5f91e194507081b4f2698074
MD5 hash:	b61f6547de40e0df3707757c35f54e74
humanhash:	kitten-salami-pizza-magnesium
File name:	Nxonq1284_QUC.zip
Download:	download sample
Signature	ValleyRAT Create hunting rule
File size:	1'142'615 bytes
First seen:	2025-08-13 05:51:03 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	24576:rZ5qXLGTwWJHdc3TKPst5YqXgMEsGkU7MJQxcv03jRtWK+:NA+Hu3OP7qXMuUAJ70ltWK+
TLSH	T1FE35BC9978594B07F6A01A3B1C3EB2C1639C2A151E6C7880726B4E1EBBD5BED31C05CF
Magika	zip
Reporter	GDHJDSYDH1
Tags:	backdoor dllHijack SilverFox ValleyRAT zip

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 5 file(s), sorted by their relevance:

File name:	MSVCP140.dll
File size:	627'992 bytes
SHA256 hash:	99e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd
MD5 hash:	c1b066f9e3e2f3a6785161a8c7e0346a
MIME type:	application/x-dosexec
Signature	ValleyRAT

File name:	vcruntime140_1.dll
File size:	49'744 bytes
SHA256 hash:	6d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e
MD5 hash:	eb49c1d33b41eb49dfed58aafa9b9a8f
MIME type:	application/x-dosexec
Signature	ValleyRAT

File name:	tier0.dll
File size:	241'313'792 bytes
SHA256 hash:	04167d99a9b9463e73233591ec47f77db4550073662c65d8ec93417e9e6d733e
MD5 hash:	cec5e7915cbd658725fbcc4e3bbdbf3f
MIME type:	application/x-dosexec
Signature	ValleyRAT

File name:	VCRUNTIME140.dll
File size:	119'376 bytes
SHA256 hash:	a06c9ea4f815dac75d2c99684d433fbfc782010fae887837a03f085a29a217e8
MD5 hash:	e9b690fbe5c4b96871214379659dd928
MIME type:	application/x-dosexec
Signature	ValleyRAT

File name:	eton.exe
File size:	1'358'432 bytes
SHA256 hash:	cd7e0a7c6316eee3fbc813c7dc8e7fd28455e639a47b47cd986c45e107c83c10
MD5 hash:	424b9acbf96a19c50cf8b99b7bc2669e
MIME type:	application/x-dosexec
Signature	ValleyRAT

Vendor Threat Intelligence

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=689c27e59901157561b5b34f

Tags:

virus

Result

Verdict:

Malicious

File Type:

ZIP File - Malicious

Link:

https://app.docguard.net/7688c08ee19cd46ad76d0a27bcd4b5f596a9732eac66afb7f877f197c1886343/results/dashboard

Behaviour

SuspiciousEmbeddedObjects detected

Gathering data

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/7688c08ee19cd46ad76d0a27bcd4b5f596a9732eac66afb7f877f197c1886343

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/7688c08ee19cd46ad76d0a27bcd4b5f596a9732eac66afb7f877f197c1886343

Score:

Verdict:

Benign

File Type:

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/250813-h3yscagr61/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.15

Link:

https://yomi.yoroi.company/submissions/7688c08ee19cd46ad76d0a27bcd4b5f596a9732eac66afb7f877f197c1886343

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PK_PUMP_AND_DUMP Create hunting rule
Author:	Will Metcalf @node5
Description:	Walks Zip Central Directory filename entries looking for abused extension then checks for a file that's at least 25M and then check to see how much uncompressed size is vs compressed size

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)