MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c3c01c2747491454c69f556aca38e7ad8cb91e4c356dd94da5ebb4a430adc270. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c3c01c2747491454c69f556aca38e7ad8cb91e4c356dd94da5ebb4a430adc270
SHA3-384 hash: d209c07924ebf2fe848190772045908a72ba32c5fabe02535490d7dab4847d03437fece66c5544aeb1fbb00f865f6a32
SHA1 hash: 29412c629b1b79af0a78d86e86a0f74c77416dc1
MD5 hash: 8be8eb6f9d1cccaed6d922ad90b3169d
humanhash: lamp-thirteen-papa-kilo
File name:2026年 第一季度违纪违规人员名单pdf.exe
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:4'242'944 bytes
First seen:2026-04-10 13:52:42 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f00bc39147e9d75e6df4afd9bdd83da7 (2 x ValleyRAT)
ssdeep 49152:NLdaZ/eMhSKhrvn3Y0wKtb4Bcbl1ps2k4xdmE7ZYeA+Jsv6tWKFdu9CiPT/G7Cwq:NgzhViGtbJsv6tWKFdu9Ci668U
TLSH T17C169D87B2B652A8D5B2C03586F7C62BD5327C058F20A5EF168877181EB37F45E3A718
TrID 49.2% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
19.4% (.EXE) Win64 Executable (generic) (6522/11/2)
13.4% (.EXE) Win32 Executable (generic) (4504/4/1)
6.0% (.EXE) OS/2 Executable (generic) (2029/13)
5.9% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter Ling
Tags:exe SilverFox Trojan/SilverFox.sad ValleyRAT


Avatar
CNGaoLing
Trojan/SilverFox.sad
IOC (Domain xzcgtffdlmn.cc)

Intelligence

File Origin
# of uploads :
1
# of downloads :
123
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
2026年 第一季度违纪违规人员名单pdf.exe
Verdict:
No threats detected
Analysis date:
2026-04-10 09:23:32 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f20a67a2-0751-4add-b65e-2c258a9bb7ff

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/61043/
Detection(s):
PUA.Win.Packer.ProtectSharewar-2
Create hunting rule

PUA.Win.Packer.ProtectSharewar-3
Create hunting rule

Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69d8fed16a61012f6ad0a42d
Tags:
sharew shell sage
Result
Verdict:
Clean
Maliciousness:

Behaviour
Launching a process
Using the Windows Management Instrumentation requests
Searching for synchronization primitives
Сreating synchronization primitives
Forced system process termination
DNS request
Connection attempt
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context anti-debug fingerprint microsoft_visual_cc
Link:
https://www.filescan.io/uploads/69d900d75ea31bc68a1e065b/reports/bb3dccaa-e287-48be-ab44-2f568f4c9185/overview
Verdict:
Malicious
Labled as:
Win64/Agent_AGeneric.MRS trojan
Link:
https://www.hybrid-analysis.com/sample/c3c01c2747491454c69f556aca38e7ad8cb91e4c356dd94da5ebb4a430adc270
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-04-10T00:14:00Z UTC
Last seen:
2026-04-10T23:54:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.Agent.xcdkys Trojan.Win32.RokRat.sb
Link:
https://opentip.kaspersky.com/c3c01c2747491454c69f556aca38e7ad8cb91e4c356dd94da5ebb4a430adc270/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/6377e214-3524-4b4e-a96e-d3968062da95
Score:
83%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c3c01c2747491454c69f556aca38e7ad8cb91e4c356dd94da5ebb4a430adc270
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c3c01c2747491454c69f556aca38e7ad8cb91e4c356dd94da5ebb4a430adc270/
Verdict:
Malicious
Threat:
Trojan.Win32.RokRat
Link:
https://tip.neiki.dev/file/c3c01c2747491454c69f556aca38e7ad8cb91e4c356dd94da5ebb4a430adc270
Threat name:
Win64.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-04-10 13:44:32 UTC
File Type:
PE+ (Exe)
Extracted files:
1
AV detection:
15 of 38 (39.47%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ypabyj2hjekfjru7kvvmuohhvwglshsmgvw5stnf5o2kimfnyjya._file
Result
Malware family:
n/a
Score:
  5/10
Tags:
discovery
Link:
https://tria.ge/reports/260410-q66w5ahy3w/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates processes with tasklist
Unpacked files
SH256 hash:
c3c01c2747491454c69f556aca38e7ad8cb91e4c356dd94da5ebb4a430adc270
MD5 hash:
8be8eb6f9d1cccaed6d922ad90b3169d
SHA1 hash:
29412c629b1b79af0a78d86e86a0f74c77416dc1
Link:
https://www.unpac.me/results/56b0ac6a-6c8c-4dc1-ac33-380d2f87c481/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/c3c01c274749/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c3c01c2747491454c69f556aca38e7ad8cb91e4c356dd94da5ebb4a430adc270

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:ProtectSharewareV11eCompservCMS
Create hunting rule
Author:malware-lu
Rule name:SUSP_Websites
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects the reference of suspicious sites that might be used to download further malware
Rule name:test_Malaysia
Create hunting rule
Author:rectifyq
Description:Detects file containing malaysia string
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ValleyRAT

Executable exe c3c01c2747491454c69f556aca38e7ad8cb91e4c356dd94da5ebb4a430adc270

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/61043/

Comments