MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96e5117b89a7f3b20cea680ebd4fe453715f4022a2cdca394b5a2c23aabe2361. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	96e5117b89a7f3b20cea680ebd4fe453715f4022a2cdca394b5a2c23aabe2361
SHA3-384 hash:	95172639a194eb403e70840c049b43e9ab45793371172d0b6cda35320c02ecd8faff6b72f7051e144660d2b382c8189d
SHA1 hash:	0ea50e2b1161e55bbed355b12283f268da1021ff
MD5 hash:	b06380cb28347af4fc2c5e294fc779c3
humanhash:	lamp-sierra-spaghetti-fix
File name:	StallStepe0.7.1.exe
Download:	download sample
Signature	ValleyRAT Alert Create hunting rule
File size:	7'355'392 bytes
First seen:	2026-06-22 08:01:21 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	372a8bd3ba4968b455522de45accd556 (2 x ValleyRAT)
ssdeep	98304:Lw8gCHziv/32yH31nDd0FikzXoT+GI6zxN8C8nTZ0BidK69c8lVJjZRDVDARH1LL:Lwx2yX1nDyFiohgNl8U4K6G8L5xoVLO0
Threatray	1 similar samples on MalwareBazaar
TLSH	T16E769A24E6A15E7E1F176BEDE04E98EF6A8FCDE306C9002527F197D2C960394840ED6D
TrID	33.1% (.EXE) Win64 Executable (generic) (6522/11/2) 25.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 10.4% (.ICL) Windows Icons Library (generic) (2059/9) 10.3% (.EXE) OS/2 Executable (generic) (2029/13) 10.1% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	cca2b3704f2dc429 (1 x ValleyRAT)
Reporter	Ling
Tags:	exe SilverFox ValleyRAT

CNGaoLing

SilverFox
IOC (IP 192.229.116.49:30003)

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

155

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

StallStepe0.7.1.exe

Verdict:

Malicious activity

Analysis date:

2026-06-22 06:26:06 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/56e91ae5-c269-431e-ad0b-e25fcfe662c7

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/71495/

CyberFortress Clean

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a38d57a86bc95245bf8810e

Tags:

n/a

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

adaptive-context anti-vm installer-heuristic overlay packed packed reconnaissance

Link:

https://www.filescan.io/uploads/6a38edcb90632a45f731a003/reports/775d486a-5ce3-40cf-80f0-46c4f9d31724/overview

Hybrid Analysis Lazy.Generic

Verdict:

Malicious

Labled as:

Lazy.Generic

Link:

https://www.hybrid-analysis.com/sample/96e5117b89a7f3b20cea680ebd4fe453715f4022a2cdca394b5a2c23aabe2361

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-06-22T04:16:00Z UTC

Last seen:

2026-06-23T23:27:00Z UTC

Hits:

~100

Detections:

Trojan.Win64.Obfuscated.v

Link:

https://opentip.kaspersky.com/96e5117b89a7f3b20cea680ebd4fe453715f4022a2cdca394b5a2c23aabe2361/results?tab=lookup

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/affd8859-ad88-40e3-b423-67574c69adeb

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/96e5117b89a7f3b20cea680ebd4fe453715f4022a2cdca394b5a2c23aabe2361

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/96e5117b89a7f3b20cea680ebd4fe453715f4022a2cdca394b5a2c23aabe2361/

Neiki Malicious

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/96e5117b89a7f3b20cea680ebd4fe453715f4022a2cdca394b5a2c23aabe2361

ReversingLabs TitaniumCloud Win64.Trojan.Yogi

Threat name:

Win64.Trojan.Yogi

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-22 06:26:11 UTC

File Type:

PE+ (Exe)

Extracted files:

8

AV detection:

21 of 38 (55.26%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=s3src64ju7z3edhknahl2t7eknyv6qbculg4uoklliwchkv6enqq._file

Threatray admintool_bulletpassview

Verdict:

malicious

Label(s):

admintool_bulletpassview

Alert

Create hunting rule

Similar samples:

ad892972e9788fff31f5f166da937d1229c7970d6e0c693164b2f484dd0c9aba

ValleyRAT

error

ValleyRAT

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/260622-jybbxsas8n/

UnpacMe

Unpacked files

SH256 hash:

96e5117b89a7f3b20cea680ebd4fe453715f4022a2cdca394b5a2c23aabe2361

MD5 hash:

b06380cb28347af4fc2c5e294fc779c3

SHA1 hash:

0ea50e2b1161e55bbed355b12283f268da1021ff

Link:

https://www.unpac.me/results/36e9fd7e-92a8-4652-b01e-824d20816a7f/

VMRay ValleyRAT

Malware family:

ValleyRAT

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/96e5117b89a7/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.30

Link:

https://yomi.yoroi.company/submissions/96e5117b89a7f3b20cea680ebd4fe453715f4022a2cdca394b5a2c23aabe2361

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ValleyRAT

exe 96e5117b89a7f3b20cea680ebd4fe453715f4022a2cdca394b5a2c23aabe2361

(this sample)

  

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/71495/