MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d457af10c19d93d98dc299be7caba09c15aaf06e2ef3a5b86bb95bf369c07222. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d457af10c19d93d98dc299be7caba09c15aaf06e2ef3a5b86bb95bf369c07222
SHA3-384 hash: 5f10628eb214cd3167c1363c1a8c125aee9fe88a630068f06aa67f4ea6988bffb32281fd8ee3f2e80560bd48a09eee63
SHA1 hash: a355cbbcfc849e14a0fcd3b3e0a00ea6377034bc
MD5 hash: b88812bb83ccef31796bc0ce775770df
humanhash: colorado-march-triple-march
File name:chronmwin.msi
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:14'188'032 bytes
First seen:2026-04-13 22:52:07 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 196608:YLlQ2gQ+LNduqXny5wE8JAL/1DwRdVYBsyHnFAdMJBUpHBaBRLY+QARnqR208S9/:YG2g1j5Ef/twn/KnecaVmYuhGp9/
Threatray 64 similar samples on MalwareBazaar
TLSH T1F1E62311A38FC226E16E0177D82EEE0EA1397EA7073041D7A3F4799E1E718C15A7DB52
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter Ling
Tags:msi SilverFox ValleyRAT


Avatar
CNGaoLing
SilverFox IOC (IP 43.154.90.28)

Intelligence

File Origin
# of uploads :
1
# of downloads :
51
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
MSI
Details
MSI
an embedded setup program or component
Link:
https://research.acce.ciphertechsolutions.com/results/ba94899d-dc86-4a53-a208-31a405ab7c97/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/61454/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69dd73b545787c53e539734f
Tags:
shellcode dridex virus blic
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm base64 CAB cmd expand expired-cert explorer explorer findstr fingerprint installer keylogger lolbin lolbin msiexec packed rundll32 short-lived-cert wix
Link:
https://www.filescan.io/uploads/69dd73b05ea31bc68a27ae91/reports/60cdd51d-c86d-4e6b-a312-77ea2a0771ce/overview
Verdict:
Suspicious
Labled as:
Win64/Valley.I trojan
Link:
https://www.hybrid-analysis.com/sample/d457af10c19d93d98dc299be7caba09c15aaf06e2ef3a5b86bb95bf369c07222
Result
Verdict:
MALICIOUS
Link:
https://labs.inquest.net/dfi/sha256/d457af10c19d93d98dc299be7caba09c15aaf06e2ef3a5b86bb95bf369c07222
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
File Type:
msi
First seen:
2026-04-08T19:55:00Z UTC
Last seen:
2026-04-15T00:38:00Z UTC
Hits:
~10
Detections:
Trojan.Win64.Agentb.sb Trojan.Win32.Shellcode.sb Trojan.Win32.Shellcode.oje
Link:
https://opentip.kaspersky.com/d457af10c19d93d98dc299be7caba09c15aaf06e2ef3a5b86bb95bf369c07222/results?tab=lookup
Score:
80%
Verdict:
Malware
File Type:
ARCHIVE
Link:
https://malprob.io/report/d457af10c19d93d98dc299be7caba09c15aaf06e2ef3a5b86bb95bf369c07222
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d457af10c19d93d98dc299be7caba09c15aaf06e2ef3a5b86bb95bf369c07222/
Verdict:
Malicious
Threat:
Trojan.Win32.Shellcode
Link:
https://tip.neiki.dev/file/d457af10c19d93d98dc299be7caba09c15aaf06e2ef3a5b86bb95bf369c07222
Threat name:
Win32.Trojan.Suschil
Create hunting rule
Status:
Malicious
First seen:
2026-04-08 07:19:37 UTC
File Type:
Binary (Archive)
Extracted files:
188
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2rl26egbtwj5tdoctg7hzk5atqk2v4dof3z2lodlxfn7g2oaoira._file
Verdict:
suspicious
Label(s):
shellcode_loader_008
Create hunting rule
Similar samples:
05a738bbfd1432db2ed33749070bf8ccf6d67ada6bb69f9ffc3d0042ef05a820
ValleyRAT
12fac68a5bea9c5b4de09f6e4285b831a213851a73cc7f41d16e677735d57e8f
ValleyRAT
276c62189026b2f7b4a4d0b35c3d37abf2fada50883e48cd4ae757d3f432af11
ValleyRAT
2f0c2610f4d617f8a29d0538de4d6792a439fafad8476fada0df369f56d5f5c9
ValleyRAT
306211d186edec4026e2191095949488583a625a7df922166073a98716d12737
ValleyRAT
3f68e521572f0d3fa00147691199d00f2f95888882bc084aa19356262222742e
ValleyRAT
9f843b6ded045fb017abd2144837a9985b12abc4f5df3fa789ad976fd61209b6
ValleyRAT
a3ff93104915c9f2d1ac765b043c5b91238eb79f79493992fce8b9aaebad292f
ValleyRAT
a777e1f816f6554cce97f5d71dc6814c30e6806ca6337ca04fd08f9e94b65e90
ValleyRAT
error
ValleyRAT
+ 54 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery persistence privilege_escalation
Link:
https://tria.ge/reports/260413-2tm42act3z/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
Enumerates connected drives
Loads dropped DLL
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d457af10c19d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d457af10c19d93d98dc299be7caba09c15aaf06e2ef3a5b86bb95bf369c07222

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_MSI_LATAM_Banker_From_LatAm
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ValleyRAT

Microsoft Software Installer (MSI) msi d457af10c19d93d98dc299be7caba09c15aaf06e2ef3a5b86bb95bf369c07222

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/61454/

Comments