MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c586f440d986aa8a61a9bbc8d1c814a97214e6a536d5ae97754a4b4c858909d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 14


Intelligence 14 IOCs 1 YARA 18 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9c586f440d986aa8a61a9bbc8d1c814a97214e6a536d5ae97754a4b4c858909d
SHA3-384 hash: 3a75e5e2031b774e13d3f167efd5d870575ddfe146ee2b2f59d280e1277396909d3a68487610076f6f191053f18e01fe
SHA1 hash: b2950afc05a020966a03aaee2651c612338db5d4
MD5 hash: 296cbd3f60d8c6e101607475f73e00e2
humanhash: red-september-carbon-pennsylvania
File name:wwwstf.msi
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:2'470'400 bytes
First seen:2025-12-03 18:58:08 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 49152:2jZw+TEanLBm/usqOVX7GpnADREFClUDxuj45G17fKFUs6KBOK:oyXwlFC2YbgUs5B
Threatray 269 similar samples on MalwareBazaar
TLSH T164B5AE217387C436D56D01B3A92EFE1A643DAD7B0B3001D7B7E8795E29704C1A27EB92
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter smica83
Tags:msi ValleyRAT

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
156.255.0.28:1688 https://threatfox.abuse.ch/ioc/1667090/

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
MSI
Details
MSI
an embedded setup program or component
Link:
https://research.acce.ciphertechsolutions.com/results/d75a20ac-e8b7-4568-b63b-813918f504e6/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/42354/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69308857264b106bd646a4bb
Tags:
shellcode trojan hype
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug base64 cmd expired-cert fingerprint installer keylogger lolbin msiexec short-lived-cert wix
Link:
https://www.filescan.io/uploads/6930884bba3b5ab4a93198c1/reports/a4414a95-fb95-471c-9ade-0ec8867206bd/overview
Verdict:
Suspicious
Labled as:
Generik.NJIUPMG trojan
Link:
https://www.hybrid-analysis.com/sample/9c586f440d986aa8a61a9bbc8d1c814a97214e6a536d5ae97754a4b4c858909d
Verdict:
Malicious
File Type:
msi
First seen:
2025-10-03T03:41:00Z UTC
Last seen:
2025-12-05T11:38:00Z UTC
Hits:
~10
Detections:
Backdoor.Xkcp.TCP.ServerRequest Backdoor.Agent.TCP.C&C Backdoor.Win32.Xkcp.a Backdoor.Androm.HTTP.Download Trojan-Spy.Win32.Stealer.sb Trojan-Downloader.OLE2.Agent.sb Trojan.Win32.Inject.sb HEUR:Trojan.Win32.Agent.gen HEUR:Trojan.Multi.ShellCode.gen
Link:
https://opentip.kaspersky.com/9c586f440d986aa8a61a9bbc8d1c814a97214e6a536d5ae97754a4b4c858909d/results?tab=lookup
Result
Threat name:
ValleyRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1825731
Signature
Allocates memory in foreign processes
Contains functionality to register a low level keyboard hook
Drops executables to the windows directory (C:\Windows) and starts them
Early bird code injection technique detected
Joe Sandbox ML detected suspicious sample
Queues an APC in another process (thread injection)
Sample or dropped binary is a compiled AutoHotkey binary
Sigma detected: Execution from Suspicious Folder
Sigma detected: Invoke-Obfuscation CLIP+ Launcher
Sigma detected: Invoke-Obfuscation VAR+ Launcher
Sigma detected: Suspicious Program Location with Network Connections
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Suricata IDS alerts for network traffic
Unusual module load detection (module proxying)
Writes to foreign memory regions
Yara detected ValleyRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1825731 Sample: wwwstf.msi Startdate: 03/12/2025 Architecture: WINDOWS Score: 100 49 Suricata IDS alerts for network traffic 2->49 51 Yara detected ValleyRAT 2->51 53 Sigma detected: Invoke-Obfuscation CLIP+ Launcher 2->53 55 5 other signatures 2->55 9 msiexec.exe 16 43 2->9         started        13 tLC.exe 2->13         started        15 msiexec.exe 2 2->15         started        process3 file4 39 C:\Windows\Installer\MSIB4FB.tmp, PE32 9->39 dropped 41 C:\Users\Public\LC\tLC.exe, PE32 9->41 dropped 43 C:\Windows\Installer\MSIB22B.tmp, PE32 9->43 dropped 45 4 other files (none is malicious) 9->45 dropped 59 Drops executables to the windows directory (C:\Windows) and starts them 9->59 17 MSIB4FB.tmp 1 9->17         started        19 msiexec.exe 9->19         started        61 Early bird code injection technique detected 13->61 63 Writes to foreign memory regions 13->63 65 Allocates memory in foreign processes 13->65 67 Sample or dropped binary is a compiled AutoHotkey binary 13->67 21 WmiPrvSE.exe 2 13->21         started        signatures5 process6 process7 23 cmd.exe 2 17->23         started        file8 37 C:\Users\Public\LC\cc.exe, PE32 23->37 dropped 26 tLC.exe 23->26         started        30 conhost.exe 23->30         started        32 cc.exe 1 23->32         started        process9 dnsIp10 47 156.255.0.28, 1688, 49687, 49688 DXTL-HKDXTLTseungKwanOServiceHK Seychelles 26->47 69 Early bird code injection technique detected 26->69 71 Contains functionality to register a low level keyboard hook 26->71 73 Writes to foreign memory regions 26->73 75 3 other signatures 26->75 34 WmiPrvSE.exe 10 2 26->34         started        signatures11 process12 signatures13 57 Unusual module load detection (module proxying) 34->57
Score:
42%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/9c586f440d986aa8a61a9bbc8d1c814a97214e6a536d5ae97754a4b4c858909d
Verdict:
inconclusive
YARA:
6 match(es)
Tags:
CAB:COMPRESSION:MSZIP Executable Office Document PDB Path PE (Portable Executable) PE File Layout SVG
Link:
https://app.malva.re/file/296cbd3f60d8c6e101607475f73e00e2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9c586f440d986aa8a61a9bbc8d1c814a97214e6a536d5ae97754a4b4c858909d/
Verdict:
Malicious
Threat:
Family.VALLEYRAT_S2
Link:
https://tip.neiki.dev/file/9c586f440d986aa8a61a9bbc8d1c814a97214e6a536d5ae97754a4b4c858909d
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=trmg6rantbvkrjq2to6i2hebjklscttkknwvv2lxkssljscyscoq._file
Verdict:
malicious
Label(s):
valleyrat
Create hunting rule
Similar samples:
5de5d098e7918e7b23cfdf7e21950afbfcceecebed42302b2554263d29571a99
ValleyRAT
76a43d739674ee3fe3f3aff78c6df2e844723a4e4dec29be95261df257d3f799
ValleyRAT
9c586f440d986aa8a61a9bbc8d1c814a97214e6a536d5ae97754a4b4c858909d
ValleyRAT
cc2935d9a93e73f312495b52fbe670727ae086b4d64467435d380b89a5e248f8
ValleyRAT
error
ValleyRAT
+ 259 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery persistence privilege_escalation ransomware
Link:
https://tria.ge/reports/251203-xmpbassqex/
Behaviour
Checks SCSI registry key(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Access Token Manipulation: Create Process with Token
Enumerates physical storage devices
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
Drops file in Windows directory
Enumerates connected drives
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Verdict:
Malicious
Tags:
ProcessKiller
YARA:
n/a
Link:
https://app.threat.zone/submission/c19f2e80-ac15-47cc-b0ba-5ee37eb9a70a
Malware family:
ValleyRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9c586f440d98/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9c586f440d986aa8a61a9bbc8d1c814a97214e6a536d5ae97754a4b4c858909d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_MSI_LATAM_Banker_From_LatAm
Create hunting rule
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:GenericGh0st
Create hunting rule
Author:Still
Rule name:Gh0stKCP
Create hunting rule
Author:Netresec
Description:Detects HP-Socket ARQ and KCP implementations, which are used in Gh0stKCP. Forked from @stvemillertime's KCP catchall rule.
Reference:https://netresec.com/?b=259a5af
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Generic_Threat_4b0b73ce
Create hunting rule
Author:Elastic Security
Rule name:win_valley_rat_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.valley_rat.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/42354/

Comments