MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a85e678fe8083a6a7372b7dafea09d986a45e9cb67f317a380daf6164bf3759c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ValleyRAT

Vendor detections: 11

Intelligence 11 IOCs 1 YARA 11 File information Comments 1

SHA256 hash:	a85e678fe8083a6a7372b7dafea09d986a45e9cb67f317a380daf6164bf3759c
SHA3-384 hash:	39bf052d3b0a5c618d5610122016b1c06e249ef639bc6505966a2fa4f7ac6894fbdf29f093478b1524410872d8df2e6e
SHA1 hash:	5d2cb470350b2a13be481de947f9cf11d7e3dc98
MD5 hash:	11b499cc40d08a10c107a6fb55a31b65
humanhash:	pennsylvania-earth-crazy-venus
File name:	11b499cc40d08a10c107a6fb55a31b65.exe
Download:	download sample
Signature	ValleyRAT Create hunting rule
File size:	891'168 bytes
First seen:	2025-02-07 09:00:14 UTC
Last seen:	2025-02-07 09:35:11 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	371137e134d5d880fd457bb09209f02c (1 x ValleyRAT)
ssdeep	12288:xJZlYEoQ8Z8gNTM6MUtLGR79Mro7ILabvHmKYmG4m4Yrw/n7BmNCntzz:7DYEoQ8Z8gC6MUtLGR799HLYmF+rwTDZ
Threatray	2 similar samples on MalwareBazaar
TLSH	T1E3156D17F76395BCC12BC1354797E772A930B8694634BA2E2E58C7226F20D608B7F724
TrID	41.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 26.1% (.EXE) Win64 Executable (generic) (10522/11/4) 12.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.1% (.ICL) Windows Icons Library (generic) (2059/9) 5.0% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
File icon (PE):
dhash icon	413562f1f0c83348 (1 x ValleyRAT)
Reporter	abuse_ch
Tags:	exe signed ValleyRAT

Code Signing Certificate

Organisation:	Google LLC
Issuer:	DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Algorithm:	sha256WithRSAEncryption
Valid from:	2025-02-04T09:40:47Z
Valid to:	2029-12-31T16:00:00Z
Serial number:	41a30a47fea0ca8345893751ec94791b
Thumbprint Algorithm:	SHA256
Thumbprint:	f2bf5fab106f82c954033e60512a62bf11ca78fb03b072c641b63e535692121c
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

abuse_ch

ValleyRAT C2:
104.219.214.206:8008

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
104.219.214.206:8008	https://threatfox.abuse.ch/ioc/1406349/

Intelligence

File Origin

# of uploads :

# of downloads :

513

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

11b499cc40d08a10c107a6fb55a31b65.exe

Verdict:

Malicious activity

Analysis date:

2025-02-07 09:02:44 UTC

Tags:

valleyrat winos rat silverfox

Link:

https://app.any.run/tasks/934dfe5c-c3b9-4723-a14a-b6c5712a0652

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Win64.MalwareX-gen.28840.24868.UNOFFICIAL

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67a5cc55ab8a2d1c6bcd6e97

Tags:

shellcode injection emotet virus

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

Verdict:

Unknown

Threat level:

n/a -.1/10

Confidence:

100%

Tags:

adaptive-context anti-debug mingw obfuscated signed

Link:

https://www.filescan.io/uploads/67a5cba3f4eccb8c3eb037a0/reports/be6a0f05-b883-4ebe-9cc9-6329bb061e7b/overview

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/a85e678fe8083a6a7372b7dafea09d986a45e9cb67f317a380daf6164bf3759c

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/763f82ec-4c3d-4302-bc57-08a0e63e395c

Result

Threat name:

GhostRat

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1609084

Signature

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Contains functionality to capture and log keystrokes

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Creates a thread in another existing process (thread injection)

Found API chain indicative of debugger detection

Found direct / indirect Syscall (likely to bypass EDR)

Found malware configuration

Hijacks the control flow in another process

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for submitted file

Sigma detected: Suspect Svchost Activity

Suricata IDS alerts for network traffic

Tries to detect sandboxes / dynamic malware analysis system (QueryWinSAT)

Writes to foreign memory regions

Yara detected GhostRat

Behaviour

Behavior Graph:

Download SVG

Score:

96%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/a85e678fe8083a6a7372b7dafea09d986a45e9cb67f317a380daf6164bf3759c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a85e678fe8083a6a7372b7dafea09d986a45e9cb67f317a380daf6164bf3759c/

Threat name:

Win64.Backdoor.GhostRAT

Status:

Malicious

First seen:

2025-02-04 16:56:05 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=vbpgpd7iba5gu43sw7np5ie5tbvel2olm7zrpi4a3l3bms7towoa._file

Verdict:

malicious

Label(s):

valleyrat

donut_injector

ValleyRAT

error

ValleyRAT

Result

Malware family:

n/a

Score:

6/10

Tags:

n/a

Link:

https://tria.ge/reports/250207-kyfgbawjbw/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Task Scheduler COM API

Uses Volume Shadow Copy WMI provider

Uses Volume Shadow Copy service COM API

Suspicious use of SetThreadContext

Enumerates connected drives

Verdict:

Informative

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/fd94b871-7568-4526-af06-678232b493f9

Unpacked files

SH256 hash:

a85e678fe8083a6a7372b7dafea09d986a45e9cb67f317a380daf6164bf3759c

MD5 hash:

11b499cc40d08a10c107a6fb55a31b65

SHA1 hash:

5d2cb470350b2a13be481de947f9cf11d7e3dc98

Link:

https://www.unpac.me/results/7a1479b9-dfa9-4bb2-a91a-e2a1091257c6/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a85e678fe808/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/a85e678fe8083a6a7372b7dafea09d986a45e9cb67f317a380daf6164bf3759c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::GetStartupInfoA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

commented on 2025-02-27 07:49:37 UTC

New Discovery: APT Silver Fox is using a stock investment decoy and undocumented Windows API functions to evade detection.
Full report:https://malwareanalysisspace.blogspot.com/2025/02/the-valleyrat-trojan-of-silver-fox-and.html