MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa87d8ffd707a18c3ea048dec53bf5f952ccf97c810448d5ac22fffecd99397d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: aa87d8ffd707a18c3ea048dec53bf5f952ccf97c810448d5ac22fffecd99397d
SHA3-384 hash: 402e7df8ecf037805239bce3100c674c9565262472e96c44cce5abdebc1ec399b4ba40b85c44b6cde00c2d7a4debc5eb
SHA1 hash: 8c44fa744be137f8bf8fd0ab15dac19f86ed8b01
MD5 hash: 93578c97850624365f00fef330f0eea7
humanhash: winter-wyoming-alaska-november
File name:データレポート.zip
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:4'838'258 bytes
First seen:2026-03-18 14:58:29 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 98304:4UWs/1PkRvKAYsTi1w8rqM+SP9EIaCUKLdKjQUO+Q8vFbCjzt2d5L3WmFCe:yG/RsJGqM+SP9E30d27Q8NbrdQDe
TLSH T19926330D5A07866A5CBCAFBC62E4ADAF03B72BDA06F61C5CF0AEDBDC55DA3740121054
TrID 66.6% (.XPI) Mozilla Firefox browser extension (8000/1/1)
33.3% (.ZIP) ZIP compressed archive (4000/1)
Magika zip
Reporter Ling
Tags:SilverFox Trojan:Win32/Vigorf.A ValleyRAT zip


Avatar
CNGaoLing
Trojan:Win32/Vigorf.A & Program:Win32/Wacapew.C!ml (Microsoft Defender)

SilverFox IOC (IP 43.134.7.102)

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
US US
File Archive Information

This file archive contains 3 file(s), sorted by their relevance:

File name:vulkan-1.bin
File size:298'544 bytes
SHA256 hash: 8e9f6d5fe55bfcf8f5744c13e3ddde132b9932ae84aaf05c6d564d0112735cd9
MD5 hash: 884c7c5c36cc64d7b2163746a12bb232
MIME type:application/octet-stream
Signature ValleyRAT
File name:データレポート.exe
File size:1'969'712 bytes
SHA256 hash: facf78d474b66ed821288db41fa6ad8a7b6f30650eb12127cb3e9a3cc6146116
MD5 hash: 72a8eb805e026accc0a5805847db978f
MIME type:application/x-dosexec
Signature ValleyRAT
File name:vulkan-1.dll
File size:4'377'605 bytes
SHA256 hash: fa22e94a98d19959c82580dc1cafcfc6ec762ed57dea9f48e3b7d0f9279a8cce
MD5 hash: 9fd5920fe1fe407dc8ba6871550ca012
MIME type:application/x-dosexec
Signature ValleyRAT
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/a25b3b6c-630a-4fcd-86e2-59b6038adad6/
Verdict:
Suspicious
Score:
50%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69aff0a3e41a5a099931bd82
Tags:
injection obfusc crypt
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm astralpe crypto crypto evasive explorer fingerprint fingerprint lolbin mpcmdrun obfuscated overlay packed packed packed regedit
Link:
https://www.filescan.io/uploads/69babdc12000fc76c3e9c11b/reports/fc5c4991-81a7-40fe-8e4c-68228232c698/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/aa87d8ffd707a18c3ea048dec53bf5f952ccf97c810448d5ac22fffecd99397d
Result
Verdict:
SUSPICIOUS
Link:
https://labs.inquest.net/dfi/sha256/aa87d8ffd707a18c3ea048dec53bf5f952ccf97c810448d5ac22fffecd99397d
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
File Type:
zip
Detections:
Trojan.Win32.Zapchast.boxg HEUR:Trojan.Win64.Generic
Link:
https://opentip.kaspersky.com/aa87d8ffd707a18c3ea048dec53bf5f952ccf97c810448d5ac22fffecd99397d/results?tab=lookup
Score:
100%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/aa87d8ffd707a18c3ea048dec53bf5f952ccf97c810448d5ac22fffecd99397d
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/aa87d8ffd707a18c3ea048dec53bf5f952ccf97c810448d5ac22fffecd99397d/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-03-18 14:59:19 UTC
File Type:
Binary (Archive)
Extracted files:
715
AV detection:
17 of 36 (47.22%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vkd5r76xa6qyypvajdpmko7v7fjmz6l4qecervnmel775tmzhf6q._file
Gathering data
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.52
Link:
https://yomi.yoroi.company/submissions/aa87d8ffd707a18c3ea048dec53bf5f952ccf97c810448d5ac22fffecd99397d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:Sectigo_Code_Signed
Create hunting rule
Description:Detects code signed by the Sectigo RSA Code Signing CA
Reference:https://bazaar.abuse.ch/export/csv/cscb/
Rule name:SelfExtractingRAR
Create hunting rule
Author:Xavier Mertens
Description:Detects an SFX archive with automatic script execution
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ValleyRAT

zip aa87d8ffd707a18c3ea048dec53bf5f952ccf97c810448d5ac22fffecd99397d

(this sample)

  
Delivery method
Distributed via web download

Comments