MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d813de09c2124bfd87ea963b031730e10bd646817cecdb5195c829c3c34d6a9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ValleyRAT

Vendor detections: 11

Intelligence 11 IOCs YARA 1 File information Comments

SHA256 hash:	8d813de09c2124bfd87ea963b031730e10bd646817cecdb5195c829c3c34d6a9
SHA3-384 hash:	19d2142e3ccfc9775500c10d3cdc2ecb92d4b93d7fffb0d2c18ed755d884d429afc2c1b7b65e5ed36c29f8be25536c55
SHA1 hash:	9c6f806fc474406403ec16c2161e41870c2b4798
MD5 hash:	f24de5e6db99994cf189a3df224a0037
humanhash:	winter-mockingbird-ack-connecticut
File name:	a-software85659006.msi
Download:	download sample
Signature	ValleyRAT Create hunting rule
File size:	6'184'960 bytes
First seen:	2026-06-28 02:24:32 UTC
Last seen:	2026-06-28 02:26:00 UTC
File type:	msi
MIME type:	application/x-msi
ssdeep	98304:1gmNIbJGVDcbdpq4ZDBZiJNsTFUnai9orzolVyddWjUcAbgA6e5P4esDgw:FNIb2iq4ZFZsNsTKnRColVvjUc9Ad+fb
TLSH	T1E4563397B5C218F8D00BDBB4025762AE713A7FD5CFA48D46B3EA790D0C7261964F2287
TrID	88.4% (.MST) Windows SDK Setup Transform script (61000/1/5) 11.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	GDHJDSYDH1
Tags:	backdoor dropper Gh0stRAT msi SilverFox ValleyRAT

Intelligence

File Origin

# of uploads :

# of downloads :

136

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

MSI

Details

Link:

https://research.acce.ciphertechsolutions.com/results/2cebe180-80ad-455e-9308-fcc871ee3e84/

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/72265/

Detection(s):

SecuriteInfo.com.FileRepMalware.66327182.UNOFFICIAL

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a4082271548daf709fa6d28

Tags:

shellcode emotet virus hype

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

bankingtrojan CAB emotet installer installer overlay packed packed persistence wix

Link:

https://www.filescan.io/uploads/6a40862450cc6999f494c81c/reports/b3ea312a-00c2-4449-ad95-a71b45b55dc0/overview

Verdict:

Malicious

Labled as:

Trojan.MSI.Agent

Link:

https://www.hybrid-analysis.com/sample/8d813de09c2124bfd87ea963b031730e10bd646817cecdb5195c829c3c34d6a9

Verdict:

Malicious

File Type:

msi

First seen:

2026-06-27T23:15:00Z UTC

Last seen:

2026-06-29T00:25:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Banker.Win32.Emotet.gen HackTool.Multi.AmsiETWPatch.sb Trojan.Win32.Agent.sba Trojan.Win32.Zapchast.bpbc Trojan.Win32.Agent.sb HEUR:Trojan.Win32.DLLhijack.pefng Trojan.Win64.Kryplod.sb Trojan.Win32.Zapchast.bpbb Trojan-Banker.Win32.Emotet.goyz HEUR:Trojan.Win32.DLLhijack.pef not-a-virus:HEUR:RiskTool.Win32.EvadeAV.gen

Link:

https://opentip.kaspersky.com/8d813de09c2124bfd87ea963b031730e10bd646817cecdb5195c829c3c34d6a9/results?tab=lookup

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8d813de09c2124bfd87ea963b031730e10bd646817cecdb5195c829c3c34d6a9/

Verdict:

Malicious

Threat:

Family.GH0ST

Link:

https://tip.neiki.dev/file/8d813de09c2124bfd87ea963b031730e10bd646817cecdb5195c829c3c34d6a9

Threat name:

Win64.Trojan.Emotet

Status:

Suspicious

First seen:

2026-06-27 19:44:43 UTC

AV detection:

11 of 38 (28.95%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rwat3ye4eesl7wd6vfr3amltbyil2zdic7hm3nizlsbjypbu22uq._file

Verdict:

malicious

Label(s):

swordldr

Similar samples:

error

ValleyRAT

Result

Malware family:

n/a

Score:

10/10

Tags:

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan

Link:

https://tria.ge/reports/260628-cwlljsez3m/

Behaviour

Uses Volume Shadow Copy service COM API

Uses Task Scheduler COM API

System policy modification

Suspicious use of WriteProcessMemory

Suspicious use of SetWindowsHookEx

Suspicious use of FindShellTrayWindow

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: LoadsDriver

Suspicious behavior: EnumeratesProcesses

Scheduled Task/Job: Scheduled Task

Runs net.exe

Modifies registry class

Modifies data under HKEY_USERS

Modifies Control Panel

Checks processor information in registry

Checks SCSI registry key(s)

Enumerates physical storage devices

Event Triggered Execution: Installer Packages

Event Triggered Execution: Screensaver

System Location Discovery: System Language Discovery

Drops file in Windows directory

Launches sc.exe

Drops file in Program Files directory

Drops file in System32 directory

Indicator Removal: Clear Persistence

Enumerates connected drives

Badlisted process makes network request

Adds Run key to start application

Modifies file permissions

Loads dropped DLL

Executes dropped EXE

Disables service(s)

Checks computer location settings

Possible privilege escalation attempt

Modifies RDP port number used by Windows

Drops file in Drivers directory

Command and Scripting Interpreter: PowerShell

Windows security bypass

UAC bypass

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8d813de09c2124bfd87ea963b031730e10bd646817cecdb5195c829c3c34d6a9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.