MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d0f63305eee18d0fff62c74beb74d2b48996f75f4c5a1fcdcd40c940c9c7f524. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 17


Intelligence 17 IOCs 1 YARA 15 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d0f63305eee18d0fff62c74beb74d2b48996f75f4c5a1fcdcd40c940c9c7f524
SHA3-384 hash: 4ab8b48f5bdf5ceb98f682daefa002f527c32c25953df572a4cd5f3bfd0feb92d2fbce7de2107b9ddeaf150fb7a21b15
SHA1 hash: b97bc7ca5f62c5fc433e1845c879bec5d8574e0e
MD5 hash: b850b0782ffb02d8eb6616064b5dd1c2
humanhash: nitrogen-uranus-kitten-tennessee
File name:d0f63305eee18d0fff62c74beb74d2b48996f75f4c5a1.exe
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:6'516'254 bytes
First seen:2026-04-28 14:05:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 99ee65c2db82c04251a5c24f214c8892 (41 x Formbook, 13 x RemcosRAT, 5 x ValleyRAT)
ssdeep 196608:0VP6DFjFbwZBMCbtSqUTq458eVS1GEihreGUoAoEQKXm:W6DBFbwDMUMnTqr11iIsEQAm
Threatray 174 similar samples on MalwareBazaar
TLSH T1B4663332BAF4F6B1D92519312A44977340786DF5FD2163AF2B9A396E4A300D05D32EB3
TrID 29.5% (.EXE) Win64 Executable (generic) (6522/11/2)
22.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
20.3% (.EXE) Win32 Executable (generic) (4504/4/1)
9.1% (.EXE) OS/2 Executable (generic) (2029/13)
9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 74f0c4ccf4f4dcc4 (5 x ValleyRAT)
Reporter abuse_ch
Tags:exe RAT ValleyRAT


Avatar
abuse_ch
ValleyRAT C2:
47.237.95.113:6523

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
47.237.95.113:6523 https://threatfox.abuse.ch/ioc/1801614/

Intelligence

File Origin
# of uploads :
1
# of downloads :
180
Origin country :
NL NL
Vendor Threat Intelligence
Malware configuration found for:
Archives
Details
Link:
https://research.acce.ciphertechsolutions.com/results/b5140935-f59d-494a-9262-dca4497a8507/
Malware family:
n/a
ID:
1
File name:
d0f63305eee18d0fff62c74beb74d2b48996f75f4c5a1fcdcd40c940c9c7f524.exe
Verdict:
Malicious activity
Analysis date:
2026-04-28 04:36:26 UTC
Tags:
auto-sch valleyrat rat silverfox winos
Link:
https://app.any.run/tasks/c5003c18-072b-42a7-b807-64a1b2dba751

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
WinosStager
Create hunting rule
Link:
https://www.capesandbox.com/analysis/63877/
Detection(s):
Win.Exploit.Rozena-10038302-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the Windows subdirectories
Creating a process from a recently created file
Running batch commands
Creating a process with a hidden window
DNS request
Connection attempt
Creating a file
Launching a process
Using the Windows Management Instrumentation requests
Reading critical registry keys
Launching the default Windows debugger (dwwin.exe)
Launching a tool to kill processes
Forced shutdown of a system process
Enabling autorun by creating a file
Gathering data
Verdict:
Malicious
Labled as:
Suspicious:Adware.HotBar.G.kotg
Link:
https://www.hybrid-analysis.com/sample/d0f63305eee18d0fff62c74beb74d2b48996f75f4c5a1fcdcd40c940c9c7f524
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-04-28T01:28:00Z UTC
Last seen:
2026-04-29T16:33:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.Dedok.cli PDM:Trojan.Win32.Generic Trojan.Win64.DllHijack.sb Trojan.Win64.DLLhijack.cxk Trojan.Win64.DLLhijack.cxl Trojan.Win32.Dedok.sb
Link:
https://opentip.kaspersky.com/d0f63305eee18d0fff62c74beb74d2b48996f75f4c5a1fcdcd40c940c9c7f524/results?tab=lookup
Malware family:
ValleyRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3c3910fe-5d1a-4151-bb1b-877b7eaa7f09
Result
Threat name:
ValleyRAT
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1905728
Signature
C2 URLs / IPs found in malware configuration
Drops executables to the windows directory (C:\Windows) and starts them
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Potential Privilege Escalation using Task Scheduler highest RunLevel
Sigma detected: Files With System Process Name In Unsuspected Locations
Suricata IDS alerts for network traffic
Unusual module load detection (module proxying)
Uses schtasks.exe or at.exe to add and modify task schedules
Windows Scripting host queries suspicious COM object (likely to drop second stage)
WScript reads language and country specific registry keys (likely country aware script)
Yara detected ValleyRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1905728 Sample: d0f63305eee18d0fff62c74beb7... Startdate: 28/04/2026 Architecture: WINDOWS Score: 100 77 Suricata IDS alerts for network traffic 2->77 79 Found malware configuration 2->79 81 Multi AV Scanner detection for submitted file 2->81 83 4 other signatures 2->83 10 d0f63305eee18d0fff62c74beb74d2b48996f75f4c5a1.exe 3 26 2->10         started        13 WUDFHost.exe 2->13         started        process3 file4 61 C:\Windows\en-US\app-3.16.5\WUDFHost.exe, PE32+ 10->61 dropped 63 C:\Windows\en-US\WUDFHost.exe, PE32 10->63 dropped 65 C:\Windows\en-US\...\vcruntime140_1.dll, PE32+ 10->65 dropped 67 3 other files (none is malicious) 10->67 dropped 16 wscript.exe 1 10->16         started        19 WUDFHost.exe 10->19         started        95 Drops executables to the windows directory (C:\Windows) and starts them 13->95 21 WUDFHost.exe 13->21         started        signatures5 process6 signatures7 73 Windows Scripting host queries suspicious COM object (likely to drop second stage) 16->73 75 WScript reads language and country specific registry keys (likely country aware script) 16->75 23 cmd.exe 1 16->23         started        26 cmd.exe 2 3 16->26         started        28 cmd.exe 1 16->28         started        30 WUDFHost.exe 19->30         started        process8 signatures9 87 Drops executables to the windows directory (C:\Windows) and starts them 23->87 32 WUDFHost.exe 23->32         started        34 taskkill.exe 1 23->34         started        36 conhost.exe 23->36         started        89 Uses schtasks.exe or at.exe to add and modify task schedules 26->89 91 Potential Privilege Escalation using Task Scheduler highest RunLevel 26->91 38 Acrobat.exe 20 58 26->38         started        40 conhost.exe 26->40         started        42 conhost.exe 28->42         started        44 tasklist.exe 1 28->44         started        46 schtasks.exe 1 28->46         started        48 find.exe 1 28->48         started        93 Unusual module load detection (module proxying) 30->93 process10 process11 50 WUDFHost.exe 2 32->50         started        54 AcroCEF.exe 38->54         started        dnsIp12 69 47.237.95.113, 49691, 6523 CHARTER-20115US United States 50->69 85 Found direct / indirect Syscall (likely to bypass EDR) 50->85 56 WerFault.exe 50->56         started        58 AcroCEF.exe 54->58         started        signatures13 process14 dnsIp15 71 23.62.176.141, 443, 49703 GTT-BACKBONEGTTDE United States 58->71
Score:
88%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d0f63305eee18d0fff62c74beb74d2b48996f75f4c5a1fcdcd40c940c9c7f524
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d0f63305eee18d0fff62c74beb74d2b48996f75f4c5a1fcdcd40c940c9c7f524/
Verdict:
Malicious
Threat:
Family.VALLEYRAT
Link:
https://tip.neiki.dev/file/d0f63305eee18d0fff62c74beb74d2b48996f75f4c5a1fcdcd40c940c9c7f524
Threat name:
Win32.Trojan.Qwexlafiba
Create hunting rule
Status:
Malicious
First seen:
2026-04-28 04:36:24 UTC
File Type:
PE (Exe)
Extracted files:
6
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=2d3dgbpo4ggq773cy5f6w5gswsezn527jrnb7tonideubsoh6usa._file
Verdict:
malicious
Label(s):
valleyrat
Create hunting rule
Similar samples:
1dd45a1200496700a9a9e138a0ecf1625c981855159ceb8624fe69b8bcfe3bb5
ValleyRAT
5f64022132943a53ac6f6e0f003d94d14329439ec313d63ccd145795406ef156
ValleyRAT
75d977c93f2220eb544fc7bd6335c5e44905d4610a54daed5193439fd356a7f5
ValleyRAT
fd1d756b6620d2410f80cb9bbdb9b21b920fb4b8606d2dc51f738fba7c058937
ValleyRAT
+ 164 additional samples on MalwareBazaar
Result
Malware family:
valleyrat_s2
Create hunting rule
Score:
  10/10
Tags:
family:valleyrat_s2 adware backdoor defense_evasion discovery execution persistence spyware
Link:
https://tria.ge/reports/260428-rd9mzsav71/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Kills process with taskkill
Modifies Internet Explorer settings
Modifies data under HKEY_USERS
Modifies registry class
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Browser Information Discovery
Enumerates physical storage devices
System Location Discovery: System Language Discovery
System Time Discovery
Drops file in Windows directory
Enumerates processes with tasklist
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Family: ValleyRat
Malware Config
C2 Extraction:
47.237.95.113:6523
Unpacked files
SH256 hash:
d0f63305eee18d0fff62c74beb74d2b48996f75f4c5a1fcdcd40c940c9c7f524
MD5 hash:
b850b0782ffb02d8eb6616064b5dd1c2
SHA1 hash:
b97bc7ca5f62c5fc433e1845c879bec5d8574e0e
Link:
https://www.unpac.me/results/bab06506-b2d0-411b-8bfc-2cd6aae7ae6f/
SH256 hash:
2a8f0ad21b4a061c08712e96a92663567ad8479f14c6d219a2fd90cdcee144dc
MD5 hash:
621a868e4687b4e04ad612620712f14d
SHA1 hash:
ff812cd355f15094c9e518152285255e910084cc
Link:
https://www.unpac.me/results/bab06506-b2d0-411b-8bfc-2cd6aae7ae6f/
Malware family:
ValleyRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d0f63305eee1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d0f63305eee18d0fff62c74beb74d2b48996f75f4c5a1fcdcd40c940c9c7f524

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Gh0stKCP
Create hunting rule
Author:Netresec
Description:Detects HP-Socket ARQ and KCP implementations, which are used in Gh0stKCP. Forked from @stvemillertime's KCP catchall rule.
Reference:https://netresec.com/?b=259a5af
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:Typical_Malware_String_Transforms
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research
Rule name:Typical_Malware_String_Transforms_RID3473
Create hunting rule
Author:Florian Roth
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:Windows_Shellcode_Rdi_edc62a10
Create hunting rule
Author:Elastic Security
Rule name:WinosStager
Create hunting rule
Author:YungBinary
Description:https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/63877/

Comments