MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 caf94d0c228124be761c85a17b7fa9ee99a60de0b21b8585df3f83d3ccc0c6ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: caf94d0c228124be761c85a17b7fa9ee99a60de0b21b8585df3f83d3ccc0c6ae
SHA3-384 hash: d2c12b1d23ca38698c55d42e202647713ae39ec1c50c2cb3a7ee641dc6ed876300801b8ccb459fa290ec3282eeee0de5
SHA1 hash: 58b9dc69afbaa23076c1d82421dc2829fe0ef91c
MD5 hash: 6867c2996601337269e7a6536b79a30b
humanhash: football-august-lithium-steak
File name:intll.0.88022.msi
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:9'244'672 bytes
First seen:2026-07-24 14:38:07 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 196608:KQy+/C68k7+rxAwulETQbAH0jI7IhOnVvrg942sC6nnGzeB50B:KQyIWk7+roEkAp7xqe90eq
TLSH T19E9633866CDDA771C097C7768603245E31683FCABC760C1FB6B97B086EB372A11B5261
TrID 88.4% (.MST) Windows SDK Setup Transform script (61000/1/5)
11.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter Ling
Tags:msi SilverFox ValleyRAT


Avatar
CNGaoLing
The sample is retrieved from "https://www.cloud-onedrive.com.cn" -> "https://www.fnik75tv.com/down24"

SilverFox
IOC (Domain zlq2s4.oss-cn-beijing.aliyuncs.com) (Domain 26nn.oss-cn-hangzhou.aliyuncs.com)

Intelligence

File Origin
# of uploads :
1
# of downloads :
84
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
MSI
Details
Link:
https://research.acce.ciphertechsolutions.com/results/252362f0-b6f1-475c-88a8-30ee10f60add/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/75961/
Detection(s):
SecuriteInfo.com.Win64.MalwareX-gen.15113178.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context bankingtrojan CAB installer installer overlay packed packed persistence wix
Link:
https://www.filescan.io/uploads/6a6378edc0b4575d45bc115c/reports/98380e8a-8495-40e7-b02c-7fce8ac9f559/overview
Verdict:
Malicious
Labled as:
Trojan.MSI.Agent
Link:
https://www.hybrid-analysis.com/sample/caf94d0c228124be761c85a17b7fa9ee99a60de0b21b8585df3f83d3ccc0c6ae
Verdict:
Malicious
File Type:
msi
First seen:
2026-07-24T10:55:00Z UTC
Last seen:
2026-07-24T19:46:00Z UTC
Hits:
~10
Detections:
HEUR:HackTool.OLE2.AmsiETWPatch.gen HEUR:Trojan-Banker.Win32.Emotet.gen HackTool.Multi.AmsiETWPatch.sb Trojan-Banker.Win32.Emotet.gpyw Trojan.Win32.Agent.sba
Link:
https://opentip.kaspersky.com/caf94d0c228124be761c85a17b7fa9ee99a60de0b21b8585df3f83d3ccc0c6ae/results?tab=lookup
Score:
7%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/caf94d0c228124be761c85a17b7fa9ee99a60de0b21b8585df3f83d3ccc0c6ae
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/caf94d0c228124be761c85a17b7fa9ee99a60de0b21b8585df3f83d3ccc0c6ae/
Threat name:
Win64.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-07-24 14:39:34 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zl4u2dbcqesl45q4qwqxw75j52m2mdpawinylbo7h6b5htgay2xa._file
Verdict:
malicious
Label(s):
SWORDLDR
Create hunting rule
Link:
https://reports.threatray.com/135691f1-fe44-47c5-905f-33171be27300
Similar samples:
012207c24a7bd9b6f7776bbd383297d2edd881cbf4855db2a64ec48e0070f525
ValleyRAT
158594224c1f0a47f405afa3577cbb8544dde58d5801a4f70775bd840990d039
ValleyRAT
6050d520c6c32743bbc64c3b56c0c5d7ae53bc072fa45352b1be8923afaf68fa
ValleyRAT
8d813de09c2124bfd87ea963b031730e10bd646817cecdb5195c829c3c34d6a9
ValleyRAT
a5dd2750e61244f975ecefad9ef22ee7524368fc2520a6cd6cf83e112fb3ccba
ValleyRAT
b8c2fd05afcfdb5f4950651117fb789dda897a29483269325f21e1dcfba5bebd
ValleyRAT
d4a2ad392b20b2e4ba82b37ade4fbdcf9c99cd22444241951c2da5fc4b675948
ValleyRAT
Result
Malware family:
n/a
Score:
  7/10
Tags:
persistence privilege_escalation ransomware
Link:
https://tria.ge/reports/260724-rz18qssdma/
Behaviour
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Event Triggered Execution: Installer Packages
Drops file in Windows directory
Drops file in System32 directory
Badlisted process makes network request
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/caf94d0c228124be761c85a17b7fa9ee99a60de0b21b8585df3f83d3ccc0c6ae

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Excel_Hidden_Macro_Sheet
Create hunting rule
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ValleyRAT

Microsoft Software Installer (MSI) msi caf94d0c228124be761c85a17b7fa9ee99a60de0b21b8585df3f83d3ccc0c6ae

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/75961/

Comments