MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9562035061eeb239e715beffe44fdfa3dadd75ad6532f533fc42570c47b27e68. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ValleyRAT

Vendor detections: 4

Intelligence 4 IOCs YARA 8 File information Comments

SHA256 hash:	9562035061eeb239e715beffe44fdfa3dadd75ad6532f533fc42570c47b27e68
SHA3-384 hash:	5849d454fc30261134aa5cbc416823f152894880809213a99779418e8089e2c54a31a0507f0cc4808e8b2be958047ab8
SHA1 hash:	00b28a7b3b57bcab3d9de43894e67c6e424ba449
MD5 hash:	4f6f17dcfcbcc63e5b60572e010230fa
humanhash:	nuts-indigo-foxtrot-apart
File name:	HttpNetword_Fix.zip
Download:	download sample
Signature	ValleyRAT Create hunting rule
File size:	564'295 bytes
First seen:	2025-06-07 15:43:08 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	6144:LzVpjdFNTLcNZIPRZUOGPdVqcCtxc7Tx65xBl/TEIfl89LbO8umVJ:DJkbIPRZMdVRQxcv03BVg+lcuyJ
TLSH	T1D2C4129874041B07F1941A3B9E7EE6C9779D37200A5C7890722B6A2EBB90BFD31C45DB
Magika	zip
Reporter	GDHJDSYDH1
Tags:	backdoor dllHijack file-pumped SilverFox ValleyRAT zip

Intelligence

File Origin

# of uploads :

# of downloads :

306

Origin country :

File Archive Information

This file archive contains 5 file(s), sorted by their relevance:

File name:	MSVCP140.dll
File size:	627'992 bytes
SHA256 hash:	99e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd
MD5 hash:	c1b066f9e3e2f3a6785161a8c7e0346a
MIME type:	application/x-dosexec
Signature	ValleyRAT

File name:	vcruntime140_1.dll
File size:	49'744 bytes
SHA256 hash:	6d3a6cde6fc4d3c79aabf785c04d2736a3e2fd9b0366c9b741f054a13ecd939e
MD5 hash:	eb49c1d33b41eb49dfed58aafa9b9a8f
MIME type:	application/x-dosexec
Signature	ValleyRAT

File name:	preorbital.exe
File size:	37'336 bytes
SHA256 hash:	d20e21de410b09412616d7afdd3d8bb8495c8efe737a9bbec293137164dbc476
MD5 hash:	96e5519af3089cf92a88175cabb8be64
MIME type:	application/x-dosexec
Signature	ValleyRAT

File name:	VCRUNTIME140.dll
File size:	119'376 bytes
SHA256 hash:	a06c9ea4f815dac75d2c99684d433fbfc782010fae887837a03f085a29a217e8
MD5 hash:	e9b690fbe5c4b96871214379659dd928
MIME type:	application/x-dosexec
Signature	ValleyRAT

File name:	libcares-2.dll
Pumped file	This file is pumped. MalwareBazaar has de-pumped it.
File size:	220'232'464 bytes
SHA256 hash:	0ff65093defb22abfca979666e44132835651764812d1eb1a63b904e5c02d98d
MD5 hash:	49fbf430102b9baf4f3069d26ede9e5c
De-pumped file size:	220'220'416 bytes (Vs. original size of 220'232'464 bytes)
De-pumped SHA256 hash:	252a8ae5ea4e2dca26ac733dc112ec4840d45b4b235482c139d048c3091e9745
De-pumped MD5 hash:	33ddac555932138b3f999f94481efa7e
MIME type:	application/x-dosexec
Signature	ValleyRAT

Vendor Threat Intelligence

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68445e978bd5d68a12e653f1

Tags:

n/a

Result

Verdict:

Malicious

File Type:

ZIP File - Malicious

Link:

https://app.docguard.net/9562035061eeb239e715beffe44fdfa3dadd75ad6532f533fc42570c47b27e68/results/dashboard

Behaviour

SuspiciousEmbeddedObjects detected

Gathering data

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/9562035061eeb239e715beffe44fdfa3dadd75ad6532f533fc42570c47b27e68

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/9562035061eeb239e715beffe44fdfa3dadd75ad6532f533fc42570c47b27e68

Score:

Verdict:

Benign

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	PK_PUMP_AND_DUMP Create hunting rule
Author:	Will Metcalf @node5
Description:	Walks Zip Central Directory filename entries looking for abused extension then checks for a file that's at least 25M and then check to see how much uncompressed size is vs compressed size

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)