MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5e71f60f77f8f7853d80ff308d7b0420e20600fe03af2529a2c8e740ed52943. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d5e71f60f77f8f7853d80ff308d7b0420e20600fe03af2529a2c8e740ed52943
SHA3-384 hash: 6e4572ebdc0735028f651c0e1b9d1389f60b2b87e306dac6dc490f7e46e08dc8c208604a93447b43867003afdb58c3ef
SHA1 hash: da7422fee4ab158c1ffb61b901e854fa375d57c0
MD5 hash: 3270606f7138f08b0c4e051d0a9ebc2b
humanhash: delta-harry-eight-yellow
File name:Notice%20from%20Tax%20Departmen.iso.dll
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:242'944 bytes
First seen:2026-07-20 10:55:24 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 8e2d33ccc73ed51abd14b6951ffbefa6 (2 x ValleyRAT)
ssdeep 3072:sz7FXq1GEfQw1ZWafRk0r+Ki/qs/ZFVIK5DUdp5nAzC6KTgtuRghqStz:LfQw1ZWaJkp5i0nTUCogqSh
TLSH T18A348D15B7A50CBAED778539C9530906EA737C4247A0EADF03904AA6CF2F7E0963E711
TrID 37.0% (.EXE) Win64 Executable (generic) (6522/11/2)
28.6% (.EXE) Win16 NE executable (generic) (5038/12/1)
11.5% (.EXE) OS/2 Executable (generic) (2029/13)
11.3% (.EXE) Generic Win/DOS Executable (2002/3)
11.3% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter abuse_ch
Tags:dll exe RAT signed ValleyRAT

Code Signing Certificate

Organisation:OKASAN ONLINE SECURITIES CO.,LTD.
Issuer:DigiCert SHA2 Assured ID Code Signing CA
Algorithm:sha256WithRSAEncryption
Valid from:2021-02-26T00:00:00Z
Valid to:2022-05-19T23:59:59Z
Serial number: 06659ede9857af399e446269319150e9
Thumbprint Algorithm:SHA256
Thumbprint: 47641366141f13055043728f8c268f5a401fbcdf2bde9a47f08a10564a4fe2c4
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
abuse_ch
ValleyRAT C2:
186.241.66.4:443

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
186.241.66.4:443 https://threatfox.abuse.ch/ioc/1854240/

Intelligence

File Origin
# of uploads :
1
# of downloads :
250
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/75426/
Detection(s):
SecuriteInfo.com.Win64.MalwareX-gen.57991481.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a5dfebb85479d70bfb781a4
Tags:
injection dropper emotet obfusc
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %AppData% subdirectories
Connection attempt
Sending a custom TCP request
Сreating synchronization primitives
Searching for synchronization primitives
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
adaptive-context anti-debug anti-vm crypto expired-cert explorer fingerprint lolbin masquerade microsoft_visual_cc schtasks signed
Link:
https://www.filescan.io/uploads/6a5dfeb37ca4544ec543c9a8/reports/e8515b6c-40a7-472f-89bf-ba4b5dd29e09/overview
Verdict:
Malicious
Link:
https://www.hybrid-analysis.com/sample/d5e71f60f77f8f7853d80ff308d7b0420e20600fe03af2529a2c8e740ed52943
Verdict:
Malicious
File Type:
dll x64
First seen:
2026-07-20T08:43:00Z UTC
Last seen:
2026-07-22T09:05:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/d5e71f60f77f8f7853d80ff308d7b0420e20600fe03af2529a2c8e740ed52943/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/daa4cd8e-f9c8-4d34-8549-6a3693c69294
Result
Threat name:
ValleyRAT
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1945161
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contains functionality to inject threads in other processes
Creates a thread in another existing process (thread injection)
Creates an autostart registry key pointing to binary in C:\Windows
Found malware configuration
Initial sample is a PE file and has a suspicious name
Injects code into the Windows Explorer (explorer.exe)
Joe Sandbox ML detected suspicious sample
Sigma detected: RunDLL32 Spawning Explorer
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Unusual module load detection (module proxying)
Writes to foreign memory regions
Yara detected ValleyRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1945161 Sample: Notice%20from%20Tax%20Depar... Startdate: 20/07/2026 Architecture: WINDOWS Score: 100 38 Suricata IDS alerts for network traffic 2->38 40 Found malware configuration 2->40 42 Yara detected ValleyRAT 2->42 44 4 other signatures 2->44 8 loaddll64.exe 19 2->8         started        process3 signatures4 54 Contains functionality to inject threads in other processes 8->54 56 Injects code into the Windows Explorer (explorer.exe) 8->56 58 Writes to foreign memory regions 8->58 60 2 other signatures 8->60 11 rundll32.exe 18 8->11         started        15 rundll32.exe 18 8->15         started        17 rundll32.exe 18 8->17         started        19 2 other processes 8->19 process5 file6 34 C:\Users\user\AppData\...\wallpaper.png, zlib 11->34 dropped 62 Injects code into the Windows Explorer (explorer.exe) 11->62 64 Writes to foreign memory regions 11->64 66 Allocates memory in foreign processes 11->66 21 explorer.exe 76 28 11->21 injected 68 Creates a thread in another existing process (thread injection) 15->68 25 rundll32.exe 18 19->25         started        signatures7 process8 dnsIp9 36 186.241.66.4, 443, 49766, 49767 AROSS-AS-AROSSCLOUDINCUS United States 21->36 46 System process connects to network (likely due to code injection or exploit) 21->46 48 Injects code into the Windows Explorer (explorer.exe) 21->48 50 Creates an autostart registry key pointing to binary in C:\Windows 21->50 52 Unusual module load detection (module proxying) 21->52 28 explorer.exe 5 4 21->28         started        30 explorer.exe 21->30         started        32 C:\Users\user\AppData\Roaming\...\host.exe, PE32+ 25->32 dropped file10 signatures11 process12
Score:
41%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/d5e71f60f77f8f7853d80ff308d7b0420e20600fe03af2529a2c8e740ed52943
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/3270606f7138f08b0c4e051d0a9ebc2b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d5e71f60f77f8f7853d80ff308d7b0420e20600fe03af2529a2c8e740ed52943/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2xtr6yhxp6hxqu6yb7zqrv5qiihcayap4a5peuu2fshhidwvffbq._file
Verdict:
malicious
Label(s):
ValleyRAT
Create hunting rule
Link:
https://reports.threatray.com/a4ae7b80-a550-48c8-98a2-47d143d760de
Similar samples:
23e82be61fb19583d1f8082a5639d61c03707558d0cba3b59f65c12eaca11a7c
ValleyRAT
47bf932521d49b5b44d5a6437aa7c558b1ab87f28d024c74545bdfecadda152b
ValleyRAT
522d1f1dad105770c597c4fd55000f25de402b5ab4b212c3e2351dd1df018aca
ValleyRAT
59b65b4f5058e38b42ec3fe79c5f05b4c29a61d00ddc6052bbbf074c99f75fef
ValleyRAT
93694473622f770d539263ae211dde4715264b0f23c858ba69796adca76cae35
ValleyRAT
ab2c1d636c9c1e6cdecb92cd50da666897a06ea4d4b159d1f9bd8cb95221a500
ValleyRAT
b2d18d22f1aff68fc7fc03c56afa5c1be8fbd93d2f4caad1bff7dfec761b50f5
ValleyRAT
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260720-m1jmvshy3z/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Unpacked files
SH256 hash:
d5e71f60f77f8f7853d80ff308d7b0420e20600fe03af2529a2c8e740ed52943
MD5 hash:
3270606f7138f08b0c4e051d0a9ebc2b
SHA1 hash:
da7422fee4ab158c1ffb61b901e854fa375d57c0
Link:
https://www.unpac.me/results/07d377f0-a806-4eb4-b5ae-05ba4c70795e/
Malware family:
ValleyRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d5e71f60f77f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d5e71f60f77f8f7853d80ff308d7b0420e20600fe03af2529a2c8e740ed52943

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/75426/

Comments