MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cac94a9e8f201edfe35a7c8eea7646979944689ab3ec8cdba6c5ffc96a16cff4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ValleyRAT

Vendor detections: 18

Intelligence 18 IOCs YARA 17 File information Comments

SHA256 hash:	cac94a9e8f201edfe35a7c8eea7646979944689ab3ec8cdba6c5ffc96a16cff4
SHA3-384 hash:	50769197d8bf2fc90b826cf025c9866c14228711720636b8d1f4d26dc82a7e6cbe6daa5679f3da5bc92de50e5056a6dd
SHA1 hash:	e3d1b4b2c225d167162b29fda290ced1bb4cdd76
MD5 hash:	4b731b8527a3018dee7892b53440e44c
humanhash:	river-apart-coffee-batman
File name:	cac94a9e8f201edfe35a7c8eea7646979944689ab3ec8cdba6c5ffc96a16cff4
Download:	download sample
Signature	ValleyRAT Create hunting rule
File size:	1'320'448 bytes
First seen:	2026-11-09 08:20:09 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	67dfe0f72cccf8d60ca58a2161c16b3f (1 x ValleyRAT)
ssdeep	24576:ypcCLCi5RaNbMxJD7nuhGumgdJjrG8Jr:EVhQeGAmr
TLSH	T1A1554BBE674508A9D1F330FCAC513083AA60BF278660FD891F47264B9F2536F1E6915E
TrID	37.0% (.EXE) Win64 Executable (generic) (6522/11/2) 28.6% (.EXE) Win16 NE executable (generic) (5038/12/1) 11.5% (.EXE) OS/2 Executable (generic) (2029/13) 11.3% (.EXE) Generic Win/DOS Executable (2002/3) 11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
dhash icon	aab2b2b2b2ba7829 (5 x ValleyRAT)
Reporter	adrian__luca
Tags:	exe ValleyRAT

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-11-09 17:25:37 UTC

Tags:

auto-reg valleyrat rat silverfox winos

Link:

https://app.any.run/tasks/89818994-4dec-450e-8d95-719869ec0d59

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

WinosStager

Link:

https://www.capesandbox.com/analysis/98388/

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af1c647ac89c90fc65aa0b5

Tags:

dropper virus sage

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Loading a system driver

Deleting a system file

Running batch commands

Creating a process with a hidden window

Creating a process from a recently created file

Connection attempt

Sending a custom TCP request

Disabling the operating system update service

Blocking the Windows Defender launch

Forced shutdown of a system process

Blocking the Windows Security Center launch

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Blocking the User Account Control

Gathering data

Verdict:

Malicious

Labled as:

Trojan.Generic

Link:

https://www.hybrid-analysis.com/sample/cac94a9e8f201edfe35a7c8eea7646979944689ab3ec8cdba6c5ffc96a16cff4

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-10-16T05:23:00Z UTC

Last seen:

2026-10-30T12:08:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/cac94a9e8f201edfe35a7c8eea7646979944689ab3ec8cdba6c5ffc96a16cff4/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/5132e0d1-e5ab-4f20-8671-8313c9c49129

Result

Threat name:

ValleyRAT

Detection:

malicious

Classification:

troj.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/2002193

Behaviour

Behavior Graph:

n/a

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/4b731b8527a3018dee7892b53440e44c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cac94a9e8f201edfe35a7c8eea7646979944689ab3ec8cdba6c5ffc96a16cff4/

Threat name:

Win64.Backdoor.Valleyrat

Status:

Malicious

First seen:

2026-11-07 06:26:00 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

22 of 38 (57.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zleuvhupeapn7y22pshou5sgs6mui2e2wpwizw5gyx74s2qwz72a._file

Verdict:

malicious

Label(s):

EraseCodeLoader

ValleyRAT

Link:

https://reports.threatray.com/5fef2254-a1eb-49fb-a3b3-2d33423c607a

Result

Malware family:

valleyrat_s2

Score:

10/10

Tags:

family:valleyrat_s2 backdoor defense_evasion discovery execution persistence trojan

Link:

https://tria.ge/reports/261109-j8n1rsa18y/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: LoadsDriver

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

System policy modification

Executes a command shell one-liner

Reads the TCP/IP host and domain name from the registry

Adds Run key to start application

Executes dropped EXE

Family: ValleyRat

UAC bypass

Malware Config

C2 Extraction:

38.60.125.204:21531
38.60.125.204:21532

Malware Family:

n/a

Verdict:

Malicious

Tags:

loader rat

YARA:

INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM ProcessInjectionTargets ParentProcessEvasion UNPROTECT_disable_process win_token ElevateUsingCOM CreateService AutorunKey

Link:

https://app.threat.zone/submission/6a9a7b83-2f6a-4169-b4ea-37f928bb68a6

Malware Family:

valley

Malicious:

True

Tags:

peexe 64bit obfuscated debugger-check exec-delay persistence

Link:

https://intel.virussign.com/intelligence/file/cac94a9e8f201edfe35a7c8eea7646979944689ab3ec8cdba6c5ffc96a16cff4

Unpacked files

SH256 hash:

cac94a9e8f201edfe35a7c8eea7646979944689ab3ec8cdba6c5ffc96a16cff4

MD5 hash:

4b731b8527a3018dee7892b53440e44c

SHA1 hash:

e3d1b4b2c225d167162b29fda290ced1bb4cdd76

Detections:

INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM

Link:

https://www.unpac.me/results/22d6510a-2a14-4792-870e-04bfe1a439aa/

Malware family:

ValleyRAT

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/cac94a9e8f20/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cac94a9e8f201edfe35a7c8eea7646979944689ab3ec8cdba6c5ffc96a16cff4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	data_manipulation Create hunting rule
Author:	Serhii Kocherhan
Description:	Detects data manipulation routines including XOR encoding, Base64 references, and RC4 PRGA encryption

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	Gh0stKCP Create hunting rule
Author:	Netresec
Description:	Detects HP-Socket ARQ and KCP implementations, which are used in Gh0stKCP. Forked from @stvemillertime's KCP catchall rule.
Reference:	https://netresec.com/?b=259a5af

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	Indicator_MiniDumpWriteDump Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects PE files and PowerShell scripts that use MiniDumpWriteDump either through direct imports or string references

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM Create hunting rule
Author:	ditekSHen
Description:	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	ValleyRAT Create hunting rule
Author:	NDA0E
Description:	Detects ValleyRAT

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	VIGIA_ValleyRAT_ead09c7c Create hunting rule
Author:	VIG-IA - Cognitive Threat Intelligence System for Smart Territories and Tourism Sector
Description:	ValleyRAT candidate detection using corroborated original-sample indicators
Reference:	https://vigia.bisite.es/

Rule name:	WinosStager Create hunting rule
Author:	YungBinary
Description:	https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign

Rule name:	WIN_Malware_ACRStealer_ForgeAuto_1084c837_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects ACRStealer (pe, etat extrait)

Rule name:	WIN_Malware_Unknown_ForgeAuto_2ffc3572 Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/98388/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample