🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3424b5b968d07d979e9b3cb46cc7c42718bd4e96fbc8e77e051264d67faf625. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 7


Intelligence 7 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3424b5b968d07d979e9b3cb46cc7c42718bd4e96fbc8e77e051264d67faf625
SHA3-384 hash: e62c2ec7b59f92714c34497abba207beade116d1d9e2c3fdbeaf6fffb9272890e8546e659108f6e8e617c507b80d5c28
SHA1 hash: 520b6ff8cd51b6fa6175b35aea41913294a46b7a
MD5 hash: 636495fe8593c95870db38e580892060
humanhash: glucose-helium-victor-mountain
File name:Cukai Syarikat Rsit-003.iso
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:1'255'424 bytes
First seen:2026-10-28 10:16:29 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 24576:7j9HOTdgjY8zaS/06T0VGKrLJKLZD4BClM:7jcpWYWaa2GCLJqM
TLSH T129455A1667B589E5C2B6953D8566C586F3B238034F619BCF22A5031E6F3B7E04E3E360
TrID 88.3% (.NULL) null bytes (2048000/1)
11.0% (.HTP) HomeLab/BraiLab Tape image (256000/1)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.2% (.CPT) Mac Compact Pro archive (5000/1/2)
0.1% (.ISO) ISO 9660 CD image (2545/36/1)
Magika iso
Reporter smica83
Tags:iso ValleyRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
HU HU
File Archive Information

This file archive contains 3 file(s), sorted by their relevance:

File name:UX64
File size:256'879 bytes
SHA256 hash: 681849e9598448ea2858a9db608c72bb4b01f89b72415c31d7835306175a45e7
MD5 hash: 0691f90e37f9a9fd10fba970002a6e32
MIME type:image/png
Signature ValleyRAT
File name:LIBCEF.DLL
File size:232'448 bytes
SHA256 hash: 53ba8a3a609aec71e01b2684e3afac41170065f99d473176e7bc217737f3d8b4
MD5 hash: 2fb5f20df0c99f497f4413a183ae12c6
MIME type:application/x-dosexec
Signature ValleyRAT
File name:OPEN_TO_VIEW_SZ7KN.EXE
File size:719'896 bytes
SHA256 hash: 6062e2a3985eba35382ac3263111b7b88d8e3e919793bf351b42ed59e24885d8
MD5 hash: e662d0fcf981a694f62c1a792645ff7b
MIME type:application/x-dosexec
Signature ValleyRAT
Vendor Threat Intelligence
Malware configuration found for:
Archives
Details
Link:
https://research.acce.ciphertechsolutions.com/results/bc4a17d7-9b37-4ad9-ac0e-a3d77ba17be6/
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae1cbb149621540087c1ee9
Tags:
n/a
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/c3424b5b968d07d979e9b3cb46cc7c42718bd4e96fbc8e77e051264d67faf625
Verdict:
Malicious
File Type:
iso
First seen:
2026-10-28T11:59:00Z UTC
Last seen:
2026-10-28T12:16:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/c3424b5b968d07d979e9b3cb46cc7c42718bd4e96fbc8e77e051264d67faf625/results?tab=lookup
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
Executable ISO9660 Image PDB Path PE (Portable Executable) PE File Layout
Link:
https://app.malva.re/file/636495fe8593c95870db38e580892060
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c3424b5b968d07d979e9b3cb46cc7c42718bd4e96fbc8e77e051264d67faf625/
Threat name:
Win32.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-10-28 06:52:09 UTC
File Type:
Binary (Archive)
Extracted files:
64
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ynbeww4wrud5s6pjwpfuntd4ijyyxvhjn66i457akete2z726ysq._file
Result
Malware family:
valleyrat_s2
Create hunting rule
Score:
  10/10
Tags:
family:valleyrat_s2 backdoor discovery persistence ransomware
Link:
https://tria.ge/reports/261028-nflr6act8q/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c3424b5b968d07d979e9b3cb46cc7c42718bd4e96fbc8e77e051264d67faf625

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments