MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d64ba1b8c36f92af1597cff997176a7029eb45063e80e721d73a931a686889f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 15


Intelligence 15 IOCs 1 YARA 27 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d64ba1b8c36f92af1597cff997176a7029eb45063e80e721d73a931a686889f9
SHA3-384 hash: ff2cb8903a74e240bd1f816ddda78f1f022339eb18c11070e4965709d237860ce7b6ca30b4fc0209857e1f8d75f1cb74
SHA1 hash: a56f67b5def2088cf5580c399de8b6c6b81439fa
MD5 hash: 65269b9f224c07eeeeeba93d766d17f1
humanhash: beryllium-cup-wolfram-berlin
File name:65269b9f224c07eeeeeba93d766d17f1.exe
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:2'054'656 bytes
First seen:2025-08-31 01:30:22 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash d42595b695fc008ef2c56aabd8efd68e (124 x Vidar, 92 x Rhadamanthys, 51 x Stealc)
ssdeep 24576:Pw62ehXPWNPlBxzL/QUi9+McE4GLjU3GFlD24KC7X3ktKIMXl7/:PwnehfczL/Q1C4y437XUt9MXl7/
Threatray 593 similar samples on MalwareBazaar
TLSH T1F7955C477C911CBAC06A93328966A5923A71BC581F7123D73E60B77C3FB3AD09979B40
TrID 44.4% (.EXE) Win64 Executable (generic) (10522/11/4)
21.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
8.7% (.ICL) Windows Icons Library (generic) (2059/9)
8.5% (.EXE) OS/2 Executable (generic) (2029/13)
8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter abuse_ch
Tags:exe RAT ValleyRAT


Avatar
abuse_ch
ValleyRAT C2:
8.149.137.211:1145

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
8.149.137.211:1145 https://threatfox.abuse.ch/ioc/1578302/

Intelligence

File Origin
# of uploads :
1
# of downloads :
76
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
65269b9f224c07eeeeeba93d766d17f1.exe
Verdict:
Malicious activity
Analysis date:
2025-08-31 01:31:13 UTC
Tags:
valley winos rat silverfox golang
Link:
https://app.any.run/tasks/077439fb-c4c4-4489-b71d-6dcc0cb9af93

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/24328/
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=68b3a5de3e988eb6ab831e5e
Tags:
emotet virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Restart of the analyzed sample
Сreating synchronization primitives
Creating a window
Connection attempt to an infection source
Sending a TCP request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm crypt golang packed threat unsafe
Link:
https://www.filescan.io/uploads/68b3a5ce6212e2f7426619a3/reports/e5e96693-7cf3-4c86-aaa1-5d17efebe3d0/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/d64ba1b8c36f92af1597cff997176a7029eb45063e80e721d73a931a686889f9
Verdict:
Malicious
File Type:
exe x64
First seen:
2025-08-28T03:58:00Z UTC
Last seen:
2025-08-28T03:58:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/d64ba1b8c36f92af1597cff997176a7029eb45063e80e721d73a931a686889f9/results?tab=lookup
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/ed8e5887-9b12-4c4d-9b5b-1a2ce7ef6885
Result
Threat name:
ValleyRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1768322
Signature
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Contains functionality to registers a callback to get notified when the system is suspended or resumed (often done by Miners)
Detected unpacking (creates a PE file in dynamic memory)
Found direct / indirect Syscall (likely to bypass EDR)
Found evasive API chain (may stop execution after checking mutex)
Found malware configuration
Found stalling execution ending in API Sleep call
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Potentially malicious time measurement code found
Suricata IDS alerts for network traffic
Tries to detect sandboxes / dynamic malware analysis system (QueryWinSAT)
Yara detected ValleyRAT
Behaviour
Behavior Graph:
Download SVG
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/d64ba1b8c36f92af1597cff997176a7029eb45063e80e721d73a931a686889f9
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 64 Exe x64
Link:
https://app.malva.re/file/65269b9f224c07eeeeeba93d766d17f1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d64ba1b8c36f92af1597cff997176a7029eb45063e80e721d73a931a686889f9/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-08-28 10:22:10 UTC
File Type:
PE+ (Exe)
Extracted files:
2
AV detection:
13 of 36 (36.11%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2zf2dogdn6jk6fmxz74zof3koau6wrigh2aooioxhkjru2dirh4q._file
Verdict:
malicious
Label(s):
donut_injector
Create hunting rule
valleyrat
Create hunting rule
Similar samples:
51e080cb60938a7836c1b0f0341936e8d2c969d227f5ba165ffb3b2d83045a1a
ValleyRAT
94844625f53130eb85f7534bd19c1f4d33706179b75ac91823d6411eca7f4338
ValleyRAT
af110662540991f377b1fe365207792cd85622eecbb115fa71be2b7183abcd97
ValleyRAT
c8e8d9c72b572aa237d3fbbca03b8ea20c9c01a747262c4266fbb86e5db46589
ValleyRAT
d64ba1b8c36f92af1597cff997176a7029eb45063e80e721d73a931a686889f9
ValleyRAT
dd18a62c3dd7f48ddabf288d271cad000e51d629c17f1e5f70127b3dc117ed30
ValleyRAT
error
ValleyRAT
+ 583 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250831-bxbbjasj12/
Behaviour
Suspicious use of WriteProcessMemory
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/fafc5f44-5d91-4298-b2f4-50d620d690e8
Unpacked files
SH256 hash:
d64ba1b8c36f92af1597cff997176a7029eb45063e80e721d73a931a686889f9
MD5 hash:
65269b9f224c07eeeeeba93d766d17f1
SHA1 hash:
a56f67b5def2088cf5580c399de8b6c6b81439fa
Link:
https://www.unpac.me/results/6e9b3039-24ba-45c8-a234-0e8d95d05f98/
Malware family:
ValleyRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/d64ba1b8c36f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/d64ba1b8c36f92af1597cff997176a7029eb45063e80e721d73a931a686889f9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:CP_AllMal_Detector
Create hunting rule
Author:DiegoAnalytics
Description:CrossPlatform All Malwares Detector: Detect PE, ELF, Mach-O, scripts, archives; overlay, obfuscation, encryption, spoofing, hiding, high entropy, network communication
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectGoMethodSignatures
Create hunting rule
Author:Wyatt Tauber
Description:Detects Go method signatures in unpacked Go binaries
Rule name:Detect_Golang_Binary
Create hunting rule
Author:Andrew Morrow
Description:Detects binaries compiled with Go
Rule name:Detect_Go_GOMAXPROCS
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata
Rule name:GoBinTest
Create hunting rule
Rule name:golang
Create hunting rule
Rule name:Golangmalware
Create hunting rule
Author:Dhanunjaya
Description:Malware in Golang
Rule name:golang_binary_string
Create hunting rule
Description:Golang strings present
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:golang_duffcopy_amd64
Create hunting rule
Rule name:HiveRansomware
Create hunting rule
Author:Dhanunjaya
Description:Yara Rule To Detect Hive V4 Ransomware
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:ProgramLanguage_Golang
Create hunting rule
Author:albertzsigovits
Description:Application written in Golang programming language
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Windows_Generic_Threat_3055c14a
Create hunting rule
Author:Elastic Security
Rule name:Windows_Trojan_Winos_464b8a2e
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/24328/

Comments