MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cec28cdad6cfe852ccf9ff9b44d22e8a39a2e5a668970c968634dcd081c8249c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 16


Intelligence 16 IOCs 1 YARA 22 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cec28cdad6cfe852ccf9ff9b44d22e8a39a2e5a668970c968634dcd081c8249c
SHA3-384 hash: 4e5a83b15da674982d45a1fecc04b81e6274b99d6745e65df25b81d7794e12ea85ece8a4d8fa72c0df668162a341a4b5
SHA1 hash: 1c50966fde50157675ebaafc97f95ee81f7650e3
MD5 hash: d92a1c341d11f888f43bdbe81086aa43
humanhash: wolfram-india-rugby-freddie
File name:D92A1C341D11F888F43BDBE81086AA43.exe
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:23'889'390 bytes
First seen:2025-12-04 11:20:23 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 4088dfe1893fc3f918b97c40d5535da7 (1 x ValleyRAT)
ssdeep 393216:8YQ07BPbe8qL/U634jEBwzlayaNd5m5ssnfLGVsxvwIg3PcPpdJBfEpA0hcBfEpu:QT8L634EwKGfLBx4Ig0rfEVIfEVu
Threatray 28 similar samples on MalwareBazaar
TLSH T1D4370122794A9173E49162B19D5ABB31017D9C659720C5C3F3C4BE2B18B25C18E3FEBE
TrID 37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
12.7% (.EXE) Win64 Executable (generic) (10522/11/4)
7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
dhash icon d4b4b2b2b29ac4d4 (1 x ValleyRAT)
Reporter abuse_ch
Tags:exe RAT ValleyRAT


Avatar
abuse_ch
ValleyRAT C2:
134.122.128.202:4567

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
134.122.128.202:4567 https://threatfox.abuse.ch/ioc/1667631/

Intelligence

File Origin
# of uploads :
1
# of downloads :
150
Origin country :
NL NL
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/6c58f693-5f82-40a7-b1b5-c01b7ae05d7d/
Malware family:
n/a
ID:
1
File name:
D92A1C341D11F888F43BDBE81086AA43.exe
Verdict:
Malicious activity
Analysis date:
2025-12-04 11:21:12 UTC
Tags:
payload sfx dropper silverfox backdoor ip-check valley winos rat valleyrat upx
Link:
https://app.any.run/tasks/bc5eb87c-9347-41e5-a669-22c5c953424f

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/42467/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69316eba7d831e2f70c8dd52
Tags:
dropper emotet virus smtp
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug base64 blackhole datper evasive fingerprint installer installer installer-heuristic microsoft_visual_cc overlay overlay packed
Link:
https://www.filescan.io/uploads/69316e81ff25e40750d351e4/reports/e7bad20b-93e3-4461-838b-c7c454e31c53/overview
Verdict:
Malicious
Labled as:
ShellcodeRunner.AAW trojan
Link:
https://www.hybrid-analysis.com/sample/cec28cdad6cfe852ccf9ff9b44d22e8a39a2e5a668970c968634dcd081c8249c
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-12-01T00:10:00Z UTC
Last seen:
2025-12-06T00:56:00Z UTC
Hits:
~100
Detections:
Backdoor.Win32.Xkcp.bpn PDM:Trojan.Win32.Generic Backdoor.Win32.Xkcp.a Backdoor.Win32.Agentb.sb Backdoor.Agent.TCP.C&C Trojan.Win32.DLLhijack.sb Trojan.Win32.DLLhijack.abni
Link:
https://opentip.kaspersky.com/cec28cdad6cfe852ccf9ff9b44d22e8a39a2e5a668970c968634dcd081c8249c/results?tab=lookup
Result
Threat name:
ValleyRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1826304
Signature
C2 URLs / IPs found in malware configuration
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Detected unpacking (creates a PE file in dynamic memory)
Found API chain indicative of debugger detection
Found evasive API chain (may stop execution after checking mutex)
Found malware configuration
Found stalling execution ending in API Sleep call
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Yara detected ValleyRAT
Behaviour
Behavior Graph:
Download SVG
Score:
86%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/cec28cdad6cfe852ccf9ff9b44d22e8a39a2e5a668970c968634dcd081c8249c
Verdict:
inconclusive
YARA:
7 match(es)
Tags:
Executable NSIS Installer PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/d92a1c341d11f888f43bdbe81086aa43
Gathering data
Verdict:
Malicious
Threat:
Family.VALLEYRAT_S2
Link:
https://tip.neiki.dev/file/cec28cdad6cfe852ccf9ff9b44d22e8a39a2e5a668970c968634dcd081c8249c
Threat name:
Win32.Malware.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-12-01 05:17:54 UTC
File Type:
PE (Exe)
Extracted files:
51
AV detection:
19 of 36 (52.78%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z3bizwwwz7uffthz76nujurori42fzngnclqzfuggtonbaoiesoa._file
Verdict:
malicious
Label(s):
valleyrat
Create hunting rule
Similar samples:
3a9f656170d4ce60d9e1f3d295aa5e0eb7d82f03d0fbd468cb9c86cf1c258f60
ValleyRAT
4eb92fd1d96c5c97501e7f470338aa541dc89dd7c45124758f8b83d120123f86
ValleyRAT
9665c6b1f427f09afb0869119566383fd33898c2df7d607406fcfc48a6d230df
ValleyRAT
9c383bf08778c98b23c23e8b0f7fb8db2a6428b972a867d90e7423e11553d38c
ValleyRAT
abf0d2be9ff5e9c6669a635f19a49c9252371189afb27814f76bb4922eccc674
ValleyRAT
c3caf1714085fbbc73fecccbd68193c2ac033833cef055e8e8948f28e62b89f4
ValleyRAT
c545763c21bc63fef87ae05eab432416cfd3b6ec576c9034d87ec3e38eafa9b8
ValleyRAT
cec28cdad6cfe852ccf9ff9b44d22e8a39a2e5a668970c968634dcd081c8249c
ValleyRAT
dece34a2c7202cc1f92f42eda9f7fef0560fccce73712cff84143a2a3343820d
ValleyRAT
error
ValleyRAT
+ 18 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery upx
Link:
https://tria.ge/reports/251204-nfnxhsvlbv/
Behaviour
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
UPX packed file
ACProtect 1.3x - 1.4x DLL software
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/a06b574c-d0cb-4e62-b4cd-c2c568b5ce14
Malware family:
ValleyRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cec28cdad6cf/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/cec28cdad6cfe852ccf9ff9b44d22e8a39a2e5a668970c968634dcd081c8249c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:APT_Sandworm_ArguePatch_Apr_2022_1
Create hunting rule
Author:Arkbird_SOLG
Description:Detect ArguePatch loader used by Sandworm group for load CaddyWiper
Reference:https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/
Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:CMD_Shutdown
Create hunting rule
Author:adm1n_usa32
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:GenericGh0st
Create hunting rule
Author:Still
Rule name:Gh0stKCP
Create hunting rule
Author:Netresec
Description:Detects HP-Socket ARQ and KCP implementations, which are used in Gh0stKCP. Forked from @stvemillertime's KCP catchall rule.
Reference:https://netresec.com/?b=259a5af
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu
Rule name:Windows_Generic_Threat_4b0b73ce
Create hunting rule
Author:Elastic Security
Rule name:winrar_sfx
Create hunting rule
Author:Kevin Falcoz
Description:Winrar SFX Archive
Rule name:win_valley_rat_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.valley_rat.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/42467/

Comments