MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b98db2b56ead04aa27ca8fe4a20d46e546baab613f0a843991512dd4e93a2570. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ValleyRAT

Vendor detections: 12

Intelligence 12 IOCs 1 YARA 23 File information Comments

SHA256 hash:	b98db2b56ead04aa27ca8fe4a20d46e546baab613f0a843991512dd4e93a2570
SHA3-384 hash:	9712fe4ef75d1a701da289f00cc04205ed26a12fecb9ad4d9f49391ad128ab850dfbbe3526e9dde5b237945fc832c0ee
SHA1 hash:	a5eed4b574121bfa19330a97a692d9a0ee237fed
MD5 hash:	248c2a231931da9a1c7c3f8de5a32b6b
humanhash:	hot-mike-sad-salami
File name:	248c2a231931da9a1c7c3f8de5a32b6b.exe
Download:	download sample
Signature	ValleyRAT Create hunting rule
File size:	1'672'704 bytes
First seen:	2026-10-15 06:10:57 UTC
Last seen:	2026-10-15 20:05:09 UTC
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	5df5eac7d1a8cb68f8fe700b326611bf (3 x ValleyRAT)
ssdeep	12288:2Iq7m1Vp38EWUu2DdjEnyRo+iD37IzGnxD3Twdk0KYM8YnNlajr88+JrFz+km9rC:217m1PlKSdjEnyS+igfdkHREe
TLSH	T12C75077FF195C17AC1EED13AD1A38F05E433B1720B33C2EB52940A669E0A9D55E3E660
TrID	51.8% (.EXE) Win64 Executable (generic) (6522/11/2) 16.1% (.EXE) OS/2 Executable (generic) (2029/13) 15.9% (.EXE) Generic Win/DOS Executable (2002/3) 15.8% (.EXE) DOS Executable (generic) (2000/1) 0.2% (.VXD) VXD Driver (29/21)
Magika	pebin
Reporter	abuse_ch
Tags:	exe RAT ValleyRAT

abuse_ch

ValleyRAT C2:
http://ruimukj.top/getinstall64

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
http://ruimukj.top/getinstall64	https://threatfox.abuse.ch/ioc/1966868/

Intelligence

File Origin

# of uploads :

# of downloads :

216

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-10-15 06:26:16 UTC

Tags:

rat valleyrat winos generic loader websocket silverfox

Link:

https://app.any.run/tasks/a4ad5c3d-163b-4bf6-8758-a76c56dcafe0

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/92115/

Detection(s):

SecuriteInfo.com.Trojan.Siggen35.64420.27373.9826.UNOFFICIAL

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad19928f4e17c78f716102d

Tags:

phishing emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Searching for synchronization primitives

Restart of the analyzed sample

Creating a process with a hidden window

DNS request

Connection attempt

Sending an HTTP GET request

Creating a file in the system32 subdirectories

Deleting a recently created file

Creating a file

Launching a process

Creating a window

Creating synchronization primitives

Moving of the original file

Unauthorized injection to a system process

Enabling autorun by creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

adaptive-context anti-debug embarcadero_delphi fingerprint packed

Link:

https://www.filescan.io/uploads/6ad06e8d68b9778d3e46f08a/reports/264ea765-a1b3-4873-8ad0-d18789e6451c/overview

Verdict:

Malicious

Labled as:

Yogi.Generic

Link:

https://www.hybrid-analysis.com/sample/b98db2b56ead04aa27ca8fe4a20d46e546baab613f0a843991512dd4e93a2570

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-10-12T11:54:00Z UTC

Last seen:

2026-10-12T12:00:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/b98db2b56ead04aa27ca8fe4a20d46e546baab613f0a843991512dd4e93a2570/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/e5426e36-aa16-4e61-8465-c86ca9115e7f

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

76 / 100

Link:

https://www.joesandbox.com/analysis/1987385

Signature

Allocates memory in foreign processes

Changes memory attributes in foreign processes to executable or writable

Creates a thread in another existing process (thread injection)

Found direct / indirect Syscall (likely to bypass EDR)

Moves itself to temp directory

Multi AV Scanner detection for submitted file

Unusual module load detection (module proxying)

Writes to foreign memory regions

Behaviour

Behavior Graph:

Download SVG

Score:

25%

Verdict:

Benign

File Type:

Link:

https://malprob.io/report/b98db2b56ead04aa27ca8fe4a20d46e546baab613f0a843991512dd4e93a2570

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/248c2a231931da9a1c7c3f8de5a32b6b

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b98db2b56ead04aa27ca8fe4a20d46e546baab613f0a843991512dd4e93a2570/

Threat name:

Win64.Trojan.Yogi

Status:

Malicious

First seen:

2026-10-12 12:44:00 UTC

AV detection:

17 of 24 (70.83%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xgg3fnlovuckuj6kr7skedkg4vdlvk3bh4fiiomrkew5j2j2evya._file

Verdict:

malicious

Label(s):

BoxedRAT

Link:

https://reports.threatray.com/5f7abd44-5225-4997-aabb-e96f4d2e3011

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/261015-gxvytsfz2t/

Unpacked files

SH256 hash:

b98db2b56ead04aa27ca8fe4a20d46e546baab613f0a843991512dd4e93a2570

MD5 hash:

248c2a231931da9a1c7c3f8de5a32b6b

SHA1 hash:

a5eed4b574121bfa19330a97a692d9a0ee237fed

Link:

https://www.unpac.me/results/965652cf-801e-4418-b0be-013925054a93/

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/b98db2b56ead/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b98db2b56ead04aa27ca8fe4a20d46e546baab613f0a843991512dd4e93a2570

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__MemoryWorkingSet Create hunting rule
Author:	Fernando Mercês
Description:	Anti-debug process memory working set size check
Reference:	http://www.gironsec.com/blog/2015/06/anti-debugger-trick-quicky/

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	MULTI_Malware_AgentTesla_ForgeAuto_ed343f78_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects AgentTesla (inconnu, etat extrait)

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	Win_Clipboard_Clipper_Thengavar Create hunting rule
Author:	Thengavar
Description:	Detects malware manipulating the Windows clipboard for clipping or crypto stealing attacks

Rule name:	WIN_Malware_Unknown_ForgeAuto_1708427c_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_2ffc3572 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_4ab123d7_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_5001c94c Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_6422f546_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_74566f98 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_79234c04 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

Rule name:	WIN_Malware_Unknown_ForgeAuto_f5d58a9e_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

Rule name:	WIN_Malware_ValleyRAT_ForgeAuto_401c5e16 Create hunting rule
Author:	Marjoriefort
Description:	Detects ValleyRAT (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/92115/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample