MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a06f070614fb6458e1c36f20e7bb512957e843f45f8da9e99bb2365126a56be9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ValleyRAT

Vendor detections: 12

Intelligence 12 IOCs 1 YARA 20 File information Comments

SHA256 hash:	a06f070614fb6458e1c36f20e7bb512957e843f45f8da9e99bb2365126a56be9
SHA3-384 hash:	adf03e7b5058279bf4c04c5b9c87c2ed53df5a44506257ddd9a970e60c0b415d29ef78909ed424a042130a804ec41069
SHA1 hash:	a0fdb5603387f73fdcbf016722ad2ce7b5c1dd51
MD5 hash:	5adf5be463b10f5d183b2608de1d3299
humanhash:	butter-floor-nevada-freddie
File name:	国税庁からの通知.exe
Download:	download sample
Signature	ValleyRAT Create hunting rule
File size:	42'105'856 bytes
First seen:	2026-02-17 13:07:40 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	0f746b0dfa3e0ccfa3f3ed5f0060f883 (1 x ValleyRAT)
ssdeep	393216:eJopKgegab/BRRObGSlExWvdPijFJQX833vJSLiAU5IKYVE1C3dJS7xUYhqh3SRi:ppmwbNlExWgQs3eaq2M
Threatray	31 similar samples on MalwareBazaar
TLSH	T134979E86B1E511E9E17BC038866B9707F7B1385507745BFB02A186792F23BD06F3AB21
TrID	37.0% (.EXE) Win64 Executable (generic) (6522/11/2) 28.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 11.5% (.EXE) OS/2 Executable (generic) (2029/13) 11.3% (.EXE) Generic Win/DOS Executable (2002/3) 11.3% (.EXE) DOS Executable Generic (2000/1)
Magika	pebin
Reporter	Ling
Tags:	dllHijack exe Generic SilverFox trojan Trojan:Win32/Yomal!rfn ValleyRAT Yomal

CNGaoLing

This sample has been reviewed by Microsoft researchers and determined to be malware. (Trojan:Win32/Yomal!rfn)

ShellcodeRunner
DLLhijack (libcef.dll) & SilverFox (yh.dat)

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
38.246.251.131:6666	https://threatfox.abuse.ch/ioc/1749920/

Intelligence

File Origin

# of uploads :

# of downloads :

279

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

2026.zip

Verdict:

Malicious activity

Analysis date:

2026-02-12 08:42:38 UTC

Tags:

arch-exec payload valleyrat silverfox rat winos

Link:

https://app.any.run/tasks/2d7b48d1-27ad-4b58-b427-4aab1dbf9ab8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6994684c2715406c647a8bf7

Tags:

virus shell sage

Verdict:

Malicious

Labled as:

Win64/ShellcodeRunner.BWG trojan

Link:

https://www.hybrid-analysis.com/sample/a06f070614fb6458e1c36f20e7bb512957e843f45f8da9e99bb2365126a56be9

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-02-04T01:36:00Z UTC

Last seen:

2026-02-04T09:50:00Z UTC

Hits:

~1000

Detections:

BSS:Trojan.Win32.Generic Backdoor.Xkcp.TCP.ServerRequest Trojan.Win32.Agentc.av HEUR:Trojan.Multi.ShellCode.gen Backdoor.Win32.Xkcp.cbv Trojan.Win64.Zenpak.sb Backdoor.Win32.Androm Backdoor.Agent.TCP.C&C Trojan-Dropper.Win32.Injector.sb Trojan.Win64.Agent.ljr Trojan.Win32.PoolInject.sba

Link:

https://opentip.kaspersky.com/a06f070614fb6458e1c36f20e7bb512957e843f45f8da9e99bb2365126a56be9/results?tab=lookup

Score:

78%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/a06f070614fb6458e1c36f20e7bb512957e843f45f8da9e99bb2365126a56be9

Gathering data

Verdict:

Malicious

Threat:

Backdoor.Win32.Zenpak

Link:

https://tip.neiki.dev/file/a06f070614fb6458e1c36f20e7bb512957e843f45f8da9e99bb2365126a56be9

Threat name:

Win64.Trojan.Yomal

Status:

Malicious

First seen:

2026-02-04 10:00:33 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

16 of 36 (44.44%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ubxqobqu7nsfryodn4qopo2rffl6qq7ul6g2t2m3wi3fcjvfnpuq._file

Verdict:

malicious

Label(s):

valleyrat

ValleyRAT

3ab3e5e88a13a48c0b659aa7d1f40c9c8f396c9fad4dda3e297ea077638bfd90

ValleyRAT

a06f070614fb6458e1c36f20e7bb512957e843f45f8da9e99bb2365126a56be9

ValleyRAT

d9a3f4e994824522d598acf36d3d28dc3abc5387f00689d5173f5a98859cb7d5

ValleyRAT

error

ValleyRAT

+ 21 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion

Link:

https://tria.ge/reports/260217-qdb62sbv3c/

Behaviour

Delays execution with timeout.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Checks computer location settings

Malware family:

ValleyRAT

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a06f070614fb/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a06f070614fb6458e1c36f20e7bb512957e843f45f8da9e99bb2365126a56be9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	BLOWFISH_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for Blowfish constants

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	mofongo_loader Create hunting rule
Author:	vrzh
Description:	Mofongo loader maps and executes a payload in a hollowed msedge process

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	skip20_sqllang_hook Create hunting rule
Author:	Mathieu Tartare <mathieu.tartare@eset.com>
Description:	YARA rule to detect if a sqllang.dll version is targeted by skip-2.0. Each byte pattern corresponds to a function hooked by skip-2.0. If $1_0 or $1_1 match, it is probably targeted as it corresponds to the hook responsible for bypassing the authentication.
Reference:	https://www.welivesecurity.com/

Rule name:	SUSP_XORed_MSDOS_Stub_Message Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed MSDOS stub message
Reference:	https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	test_Malaysia Create hunting rule
Author:	rectifyq
Description:	Detects file containing malaysia string

Rule name:	vmdetect Create hunting rule
Author:	nex
Description:	Possibly employs anti-virtualization techniques

Rule name:	WHIRLPOOL_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for WhirlPool constants

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ValleyRAT

exe a06f070614fb6458e1c36f20e7bb512957e843f45f8da9e99bb2365126a56be9

(this sample)

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample