MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 84fd7e7de84bf9080ec938f944b81807faa769ab2e27a4d0a5f8596ff6dc0072. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ValleyRAT

Vendor detections: 11

Intelligence 11 IOCs 1 YARA 26 File information Comments

SHA256 hash:	84fd7e7de84bf9080ec938f944b81807faa769ab2e27a4d0a5f8596ff6dc0072
SHA3-384 hash:	1bb95432aa27ca6fd220fd1ac99e7002d8d7cb17870057e673abeb5055a92d36763c5b48a3c16bdc5e05ed35412d5d7f
SHA1 hash:	eef695b8dfbe7783c81cd127c525543835cef9ec
MD5 hash:	345bd23aae7e28c9b249b81a245f6c8d
humanhash:	cola-uncle-twelve-diet
File name:	fdsfsffdsf.shop_313.exe
Download:	download sample
Signature	ValleyRAT Create hunting rule
File size:	5'687'296 bytes
First seen:	2026-10-09 03:20:58 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	5df5eac7d1a8cb68f8fe700b326611bf (2 x ValleyRAT)
ssdeep	98304:DN2yeSEOf51tnXTxQ9LMF6ebZGaL0nDHPBQod:5LeS3f5PnXdQKPFL07BPd
TLSH	T19046E07FF1A5C17AC1EED13AD1A38B05E433B0760B33C2E752D40A668E0A9D55E7E660
TrID	63.7% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 10.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 9.9% (.EXE) Win64 Executable (generic) (6522/11/2) 6.9% (.EXE) Win32 Executable (generic) (4504/4/1) 3.1% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	Ling
Tags:	exe SilverFox Trojan/SilverFox.bg[qtsc] ValleyRAT

CNGaoLing

fdsfsffdsf.shop_313.exe

Trojan/SilverFox.bg[qtsc]
IOC (Domain fdsfsffdsf.shop) (IP 156.251.16.92:80)

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://fdsfsffdsf.shop/getinstall64	https://threatfox.abuse.ch/ioc/1958138/

Intelligence

File Origin

# of uploads :

# of downloads :

231

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

fdsfsffdsf.shop_313.exe

Verdict:

Malicious activity

Analysis date:

2026-10-09 02:34:15 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/ab1c2ea8-f873-4da1-8d7b-09c0100cf5d4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/91204/

Detection(s):

SecuriteInfo.com.Malware.PDB-938.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Searching for synchronization primitives

Restart of the analyzed sample

Creating a process with a hidden window

DNS request

Connection attempt

Sending an HTTP GET request

Creating a file in the system32 subdirectories

Deleting a recently created file

Creating a file

Launching a process

Creating a window

Сreating synchronization primitives

Moving of the original file

Unauthorized injection to a system process

Enabling autorun by creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug embarcadero_delphi evasive expired-cert fingerprint installer-heuristic lolbin masquerade packed remoteaccesstool rundll32

Link:

https://www.filescan.io/uploads/6ac85dac4adbbf8f31b7951e/reports/104cdd40-2919-402e-baed-42e10a5477c9/overview

Verdict:

Malicious

Labled as:

Yogi.Generic

Link:

https://www.hybrid-analysis.com/sample/84fd7e7de84bf9080ec938f944b81807faa769ab2e27a4d0a5f8596ff6dc0072

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-10-07T21:28:00Z UTC

Last seen:

2026-10-10T18:53:00Z UTC

Hits:

~100

Detections:

Trojan.Win64.SilverFox.die BSS:Trojan.Win32.Generic

Link:

https://opentip.kaspersky.com/84fd7e7de84bf9080ec938f944b81807faa769ab2e27a4d0a5f8596ff6dc0072/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/ec2bd1e5-f798-4690-9311-fdb4e0669638

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/84fd7e7de84bf9080ec938f944b81807faa769ab2e27a4d0a5f8596ff6dc0072

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/345bd23aae7e28c9b249b81a245f6c8d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/84fd7e7de84bf9080ec938f944b81807faa769ab2e27a4d0a5f8596ff6dc0072/

Threat name:

Win64.Trojan.Silverfox

Status:

Malicious

First seen:

2026-10-09 03:21:27 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qt6x47pijp4qqdwjhd4ujoaya75ko2nlfyt2juff7bmw75w4abza._file

Verdict:

malicious

Label(s):

BoxedRAT

Link:

https://reports.threatray.com/e24e493d-2996-4b71-9ed2-f7dabf9c973f

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/261009-dwfwqs1x3l/

Unpacked files

SH256 hash:

84fd7e7de84bf9080ec938f944b81807faa769ab2e27a4d0a5f8596ff6dc0072

MD5 hash:

345bd23aae7e28c9b249b81a245f6c8d

SHA1 hash:

eef695b8dfbe7783c81cd127c525543835cef9ec

Link:

https://www.unpac.me/results/91e14505-b946-4e1f-97a8-739c0f2066ba/

SH256 hash:

5db40cebbcef6463b89266adde98f1f9441ae56539f3ec696044708db5790392

MD5 hash:

95528a20838c10731661b5d1d2dad755

SHA1 hash:

802f1cd1ee71d9c64a059faeefac3c1d62bc2cc9

Link:

https://www.unpac.me/results/91e14505-b946-4e1f-97a8-739c0f2066ba/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/84fd7e7de84b/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/84fd7e7de84bf9080ec938f944b81807faa769ab2e27a4d0a5f8596ff6dc0072

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Anydesk Create hunting rule
Author:	CD_R0M_
Description:	Anydesk is commonly used by threat actors for remote access. This rule aims to identify legitimate anydesk, renamed binaries and trojanized versions.
Reference:	https://www.crowdstrike.com/blog/falcon-complete-disrupts-malvertising-campaign-targeting-anydesk/

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__MemoryWorkingSet Create hunting rule
Author:	Fernando Mercês
Description:	Anti-debug process memory working set size check
Reference:	http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	MULTI_Malware_AgentTesla_ForgeAuto_ed343f78_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects AgentTesla (inconnu, etat extrait)

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	TH_Generic_MassHunt_Win_Malware_2025_CYFARE Create hunting rule
Author:	CYFARE
Description:	Generic Windows malware mass-hunt rule - 2025
Reference:	https://cyfare.net/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	Win_Clipboard_Clipper_Thengavar Create hunting rule
Author:	Thengavar
Description:	Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks

Rule name:	WIN_Malware_Unknown_ForgeAuto_1708427c_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_2ffc3572 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_4ab123d7_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_5001c94c Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_6422f546_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_74566f98 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_79234c04 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_f5d58a9e_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_ValleyRAT_ForgeAuto_401c5e16 Create hunting rule
Author:	Marjoriefort
Description:	Detects ValleyRAT (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ValleyRAT

exe 84fd7e7de84bf9080ec938f944b81807faa769ab2e27a4d0a5f8596ff6dc0072

(this sample)

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/91204/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample