MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e21f3aeea96d71deb10108b8d030bb2e7ce2e0ce85a12e1855ff7c56ce83535. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8e21f3aeea96d71deb10108b8d030bb2e7ce2e0ce85a12e1855ff7c56ce83535
SHA3-384 hash:	4b58a9febd5145beb9859b8168cbad1233d98fab4de50fd48e45de4bb7b9b736128b591004277d7e2e1cbbe459f17ea3
SHA1 hash:	e3db80d5c4cf9d4b628b3b4336cbf3323a309dea
MD5 hash:	109dd7b90222457218257ac780884a5e
humanhash:	fillet-grey-florida-juliet
File name:	HelloWorld精简版-win-2.1.2—883x8cv—hoolefanyi-x64.msi
Download:	download sample
Signature	ValleyRAT Alert Create hunting rule
File size:	90'633'216 bytes
First seen:	2025-11-08 12:20:41 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	1572864:cJ84khetrOWndFawKj4aGBwagRO0+qkjywmJ0945V/IA:5Qtr/ndFawa4aGStR1+tjCGO5FI
Threatray	825 similar samples on MalwareBazaar
TLSH	T188183331B2777995D52FA77FE0A86F884430BCE1731AE5AB63783FA686716436071803
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	aachum
Tags:	27-124-21-207 CHN cn-teams-com msi ValleyRAT winos

iamaachum

https://www.cn-teams.com/download.php => https://llllllsl6622perjwrhwnzhakagoqgk.s3.ap-east-1.amazonaws.com/hoolefanyi.zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

57

Origin country :

ES

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=690f35ca3afb53888cc9b28d

Tags:

n/a

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/8e21f3aeea96d71deb10108b8d030bb2e7ce2e0ce85a12e1855ff7c56ce83535

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

msi

First seen:

2025-11-08T09:48:00Z UTC

Last seen:

2025-11-08T10:32:00Z UTC

Hits:

~10

Detections:

Trojan.Win64.Agent.sb HEUR:Trojan-Dropper.Win32.Agent.gen

Link:

https://opentip.kaspersky.com/8e21f3aeea96d71deb10108b8d030bb2e7ce2e0ce85a12e1855ff7c56ce83535/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1810512

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

52%

Verdict:

Susipicious

File Type:

ARCHIVE

Link:

https://malprob.io/report/8e21f3aeea96d71deb10108b8d030bb2e7ce2e0ce85a12e1855ff7c56ce83535

CERT.PL MWDB

Gathering data

Neiki Trojan-Dropper.Win32.Agent

Verdict:

Malicious

Threat:

Trojan-Dropper.Win32.Agent

Link:

https://tip.neiki.dev/file/8e21f3aeea96d71deb10108b8d030bb2e7ce2e0ce85a12e1855ff7c56ce83535

ReversingLabs TitaniumCloud Win64.Trojan.Generic

Threat name:

Win64.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-11-08 12:21:29 UTC

File Type:

Binary (Archive)

Extracted files:

2450

AV detection:

6 of 24 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ryq7hlxks3lr32yqccfy2aylwlt44lqm5bnbfymfl734k3higu2q._file

Threatray donutloader

Verdict:

malicious

Label(s):

donutloader

Alert

Create hunting rule

Similar samples:

0aeccb14399537299f4818ad8fc6afb408261df3ea184ff207fe69cd313dcead

ValleyRAT

6490a19d1b236722f4560e3c59722b16319ff3b4a425897b4c513f6ac8a7524c

ValleyRAT

69c5329cdbe691992a4add7d9f37bd63d5f9fc618ccf3ceef3f2622cfc229dff

ValleyRAT

7c2769b905c5142f6236c48b071aef3ed4ec9895e7c132a868c725bb43a064e7

ValleyRAT

8e21f3aeea96d71deb10108b8d030bb2e7ce2e0ce85a12e1855ff7c56ce83535

ValleyRAT

9315d5eedd07e2b078b39d1dc04ae604b1468e1918f897477b3a77c728aa1f22

ValleyRAT

9437275ee94d0a2b491181366be2ef6f0ac106599516bb7ab3c1a5c5df0a5021

ValleyRAT

error

ValleyRAT

f31f25df2482de053668626c602a16ae43962b81fe3c3a5892468666bcfb0aa0

ValleyRAT

+ 815 additional samples on MalwareBazaar

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

discovery persistence privilege_escalation

Link:

https://tria.ge/reports/251108-pjf7hsynfr/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Loads dropped DLL

Enumerates connected drives

Threat.Zone Suspicious

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/efbe6227-b5da-46c5-9917-c9af51b822d3

VMRay ValleyRAT

Malware family:

ValleyRAT

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/8e21f3aeea96/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.