MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 931ce3beac7484c2bab59eb90ee0b8230823a2f7b0dbfd6ffd4296767b0640b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 931ce3beac7484c2bab59eb90ee0b8230823a2f7b0dbfd6ffd4296767b0640b8
SHA3-384 hash: 5879018a51e69e4b133dbf03c88d87b354e76a4b4dfb06bc9a929cba8ebeb298f6aff54651775699786139359516a9ff
SHA1 hash: 6c05f1d4a1d5ab6414f2df877978cf253c2f2d30
MD5 hash: 47a4f35908f85c4a3fbe536341989d7a
humanhash: four-high-may-ten
File name:47A4F35908F85C4A3FBE536341989D7A.dll
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:341'504 bytes
First seen:2026-08-04 21:45:24 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 3d78bbe1faa6a6dae6c4cb9020627809 (2 x ValleyRAT)
ssdeep 6144:8n+06yirywPV6q6KRIb1qkNMJ5A8S0+z2oQ9UeFMr:Ah6yiBP3DkK5A8S0+2ouU
TLSH T1EF746C21B291C236D5AE1130A679DB7B0D7D78310BE5D0CBA3D04E6E1E217E2EE3475A
TrID 22.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
22.7% (.EXE) Win64 Executable (generic) (6522/11/2)
17.5% (.EXE) Win16 NE executable (generic) (5038/12/1)
15.7% (.EXE) Win32 Executable (generic) (4504/4/1)
7.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika pebin
Reporter abuse_ch
Tags:dll RAT ValleyRAT


Avatar
abuse_ch
ValleyRAT C2:
118.107.43.220:8080

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
118.107.43.220:8080 https://threatfox.abuse.ch/ioc/1868538/

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Detection:
WinosStager
Create hunting rule
Link:
https://www.capesandbox.com/analysis/78868/
Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching a service
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug cmd crypto evasive explorer farfli fingerprint lolbin microsoft_visual_cc reconnaissance rundll32
Link:
https://www.filescan.io/uploads/6a725daa724bb2d1fe04de0d/reports/63e66306-83dd-4c57-9c77-36cded1b1247/overview
Verdict:
Malicious
Labled as:
Dump:Generic.Malware.LPfoPk
Link:
https://www.hybrid-analysis.com/sample/931ce3beac7484c2bab59eb90ee0b8230823a2f7b0dbfd6ffd4296767b0640b8
Malware family:
ValleyRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4015137c-7baa-4998-986b-a84be88ff487
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
64 / 100
Link:
https://www.joesandbox.com/analysis/1952302
Signature
Antivirus / Scanner detection for submitted sample
Contains functionality to inject threads in other processes
Delayed program exit found
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1952302 Sample: feEKamLUOP.dll Startdate: 04/08/2026 Architecture: WINDOWS Score: 64 18 Antivirus / Scanner detection for submitted sample 2->18 20 Multi AV Scanner detection for submitted file 2->20 7 loaddll32.exe 1 2->7         started        process3 signatures4 22 Contains functionality to inject threads in other processes 7->22 24 Delayed program exit found 7->24 10 cmd.exe 1 7->10         started        12 conhost.exe 7->12         started        14 rundll32.exe 7->14         started        process5 process6 16 rundll32.exe 10->16         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/931ce3beac7484c2bab59eb90ee0b8230823a2f7b0dbfd6ffd4296767b0640b8
Verdict:
Vidar Stealer
YARA:
6 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Stealer Vidar Stealer Win 32 Exe x86
Malware Config
C2 Extraction:
CNC: https://ssl.xui.ptlogin2.weiyun.com/cgi-bin/xlogin?appid=527020901&daid=372&low_login=0&qlogin_auto_login=1&s_url=https://www.weiyun.com/web/callback/common_qq_login_ok.html?login_succ&style=20&hide_title=1&target=self&link_target=blank&hide_close_icon=1&p
CNC: https://www.weiyun.com/web/callback/common_qq_login_ok.html?login_succ&style=20&hide_title=1&target=self&link_target=blank&hide_close_icon=1&pt_no_auth=1Microsoft Internet ExplorerGETpt_local_token=;/pt_get_uins?callback=ptui_getuins_CB&r=0.&pt_lo
CNC: https://ssl.xui.ptlogin2.weiyun.com/account/pt_get_st?clientuin=&callback=ptui_getst_CB&pt_local_tk=clientkey=/jump?clientuin=&clientkey=&keyindex=9&u1=https://www.weiyun.com/web/callback/common_qq_login_ok.html?login_succ&pt_local_tk=&p
CNC: https://www.weiyun.com/web/callback/common_qq_login_ok.html?login_succ&pt_local_tk=&pt_3rd_aid=0&ptopt=1&style=40ptlogin2.qq.comReferer: https://ptlogin2.qq.com/ check_sig?'/check_sig?skey=ssl.ptl
Link:
https://app.malva.re/file/47a4f35908f85c4a3fbe536341989d7a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/931ce3beac7484c2bab59eb90ee0b8230823a2f7b0dbfd6ffd4296767b0640b8/
Threat name:
Win32.Backdoor.Valleyrat
Create hunting rule
Status:
Malicious
First seen:
2026-08-03 16:53:00 UTC
File Type:
PE (Dll)
AV detection:
29 of 36 (80.56%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=smoohpvmoscmfovvt24q5yfyemechixxwdn72375iklhm6ygic4a._file
Verdict:
malicious
Label(s):
ValleyRAT
Create hunting rule
Link:
https://reports.threatray.com/d08bcb9a-79dc-412f-9a13-c55a451fd747
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/260804-1mkjwsep6y/
Behaviour
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Unpacked files
SH256 hash:
931ce3beac7484c2bab59eb90ee0b8230823a2f7b0dbfd6ffd4296767b0640b8
MD5 hash:
47a4f35908f85c4a3fbe536341989d7a
SHA1 hash:
6c05f1d4a1d5ab6414f2df877978cf253c2f2d30
Detections:
win_winos_auto
Create hunting rule
triage_winos_rat_plugin_manager
Create hunting rule
Link:
https://www.unpac.me/results/e181fd30-ffeb-4b63-94be-45c9b08cb7c4/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/931ce3beac7484c2bab59eb90ee0b8230823a2f7b0dbfd6ffd4296767b0640b8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:GenericGh0st
Create hunting rule
Author:Still
Rule name:Gh0stKCP
Create hunting rule
Author:Netresec
Description:Detects HP-Socket ARQ and KCP implementations, which are used in Gh0stKCP. Forked from @stvemillertime's KCP catchall rule.
Reference:https://netresec.com/?b=259a5af
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess
Create hunting rule
Author:ditekSHen
Description:Detects executables calling ClearMyTracksByProcess
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:Windows_Generic_Threat_4b0b73ce
Create hunting rule
Author:Elastic Security
Rule name:WinosStager
Create hunting rule
Author:YungBinary
Description:https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign
Rule name:win_winos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.winos.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/78868/

Comments