MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c668fdf9cd5bc613c047c64dbc6c1e68b76c178b08a1df57463a9404d2cc4328. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ValleyRAT

Vendor detections: 9

Intelligence 9 IOCs 1 YARA 15 File information Comments

SHA256 hash:	c668fdf9cd5bc613c047c64dbc6c1e68b76c178b08a1df57463a9404d2cc4328
SHA3-384 hash:	a7d8bafa7b96abaec6141101090088354e5e899ad8c9ddefdf3b6f3a7f4541200cf3f0f8f4609d58e6a4821913cf3a56
SHA1 hash:	0c7618f9eb757018fcd2aebb1aaa597c3dbbdfc8
MD5 hash:	c7070dc55dccf091e0ff6a80a2c41c0f
humanhash:	utah-oxygen-iowa-network
File name:	115Q3????M??.hta
Download:	download sample
Signature	ValleyRAT Create hunting rule
File size:	5'571'755 bytes
First seen:	2026-09-28 20:15:16 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	12288:KbL/PYur3KmSHFBQFiStbiqaEAr4fQD8nq4iy0F2y3jjyILgB+VhLEnFk7Zx5Q1t:K
TLSH	T1CE461CE73102F55EC18543B16F2917E0543ED6189ACA4D0AFA89CF9DA1CDCDB3AAD381
Magika	html
Reporter	abuse_ch
Tags:	hta RAT ValleyRAT

abuse_ch

ValleyRAT C2:
108.187.43.208:449

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
108.187.43.208:449	https://threatfox.abuse.ch/ioc/1941228/

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

{HEX}js.downloader.email-phishing.149.UNOFFICIAL

Js.Downloader.Email_phishing-1

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/c668fdf9cd5bc613c047c64dbc6c1e68b76c178b08a1df57463a9404d2cc4328/results/dashboard

Behaviour

BlacklistAPI detected

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug anti-vm base64 cmd dropper evasive evasive exploit explorer fingerprint lolbin obfuscated ping reconnaissance

Link:

https://www.filescan.io/uploads/6abacae3f1e9dd1a96762c1e/reports/ab61d31c-4f4a-4272-b90e-916a8f07455d/overview

Verdict:

Suspicious

Labled as:

JS/TrojanDropper.Agent

Link:

https://www.hybrid-analysis.com/sample/c668fdf9cd5bc613c047c64dbc6c1e68b76c178b08a1df57463a9404d2cc4328

Verdict:

Malicious

File Type:

hta

First seen:

2026-09-27T19:55:00Z UTC

Last seen:

2026-09-29T06:26:00Z UTC

Hits:

~1000

Link:

https://opentip.kaspersky.com/c668fdf9cd5bc613c047c64dbc6c1e68b76c178b08a1df57463a9404d2cc4328/results?tab=lookup

Result

Threat name:

SilverFox Rootkit, ValleyRAT

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1979136

Signature

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Contains functionality to inject threads in other processes

Contains functionality to modify Windows User Account Control (UAC) settings

Detected unpacking (creates a PE file in dynamic memory)

Disable UAC(promptonsecuredesktop)

Found malware configuration

Found stalling execution ending in API Sleep call

Joe Sandbox ML detected suspicious sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Sample is not signed and drops a device driver

Self deletion via cmd or bat file

Sigma detected: Suspicious MSHTA Child Process

Sigma detected: Suspicious Ping/Del Command Combination

Suricata IDS alerts for network traffic

Tries to detect sandboxes / dynamic malware analysis system (Installed program check)

Unusual module load detection (module proxying)

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Writes to foreign memory regions

Yara detected SilverFox Rootkit

Yara detected UAC Bypass using CMSTP

Yara detected ValleyRAT

Behaviour

Behavior Graph:

Download SVG

Score:

96%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/c668fdf9cd5bc613c047c64dbc6c1e68b76c178b08a1df57463a9404d2cc4328

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

Html

Link:

https://app.malva.re/file/c7070dc55dccf091e0ff6a80a2c41c0f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c668fdf9cd5bc613c047c64dbc6c1e68b76c178b08a1df57463a9404d2cc4328/

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=yzup36onlpdbhqchyzg3y3a6nc3wyf4lbcq56v2ghkkajuwmimua._file

Result

Malware family:

valleyrat_s2

Score:

10/10

Tags:

family:valleyrat_s2 backdoor defense_evasion discovery execution persistence trojan

Link:

https://tria.ge/reports/260928-y1sfjssgka/

Behaviour

Modifies registry class

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

System policy modification

Enumerates physical storage devices

Executes a command shell one-liner

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Adds Run key to start application

Checks installed software on the system

Enumerates connected drives

Checks computer location settings

Executes dropped EXE

Detects ValleyRAT payload

Family: ValleyRat

UAC bypass

Malware Config

C2 Extraction:

108.187.43.208:449
108.187.43.208:443

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.20

Link:

https://yomi.yoroi.company/submissions/c668fdf9cd5bc613c047c64dbc6c1e68b76c178b08a1df57463a9404d2cc4328

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CMD_Ping_Localhost Create hunting rule

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Gh0stKCP Create hunting rule
Author:	Netresec
Description:	Detects HP-Socket ARQ and KCP implementations, which are used in Gh0stKCP. Forked from @stvemillertime's KCP catchall rule.
Reference:	https://netresec.com/?b=259a5af

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	Indicator_MiniDumpWriteDump Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	SUSP_EXE_in_ISO Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects ISO files that contains an Exe file. Does not need to be malicious
Reference:	Internal Research

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	ValleyRAT Create hunting rule
Author:	NDA0E
Description:	Detects ValleyRAT

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	Windows_Generic_Threat_3055c14a Create hunting rule
Author:	Elastic Security

Rule name:	WinosStager Create hunting rule
Author:	YungBinary
Description:	https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample