🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d7139ffe2d9e04c6ac1df903e0c9236aa7d0561ab5cb78022406bc016cdc4890. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 7


Intelligence 7 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d7139ffe2d9e04c6ac1df903e0c9236aa7d0561ab5cb78022406bc016cdc4890
SHA3-384 hash: 78f9632e335405d06f03236d528a9b515b96c9a519b9b4b731d1c9c6bbd692a60010dc21394029b2e5edf81c54fcca2b
SHA1 hash: 4b9eb12395067f7fc30f87d501d238d8424e27a0
MD5 hash: 55d06721b77b449b38f747816564de69
humanhash: steak-comet-enemy-winter
File name:z31Open_to_view_1abd.iso
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:303'104 bytes
First seen:2026-10-19 15:00:12 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 3072:4AkO5xOPOhTFR9BYr3Pmm4aZIzXOhBgXoabd+FFv1NL1Djwj0gfxtP2dU/VKk6OP:LkmOs9DZaZITOhYoAUvvOjPxtLID
TLSH T18854EFAEDF808DE6CE5AD1B0C4A1F164D86A78794A81D47F3F1D18661F32B28643DF18
TrID 88.5% (.NULL) null bytes (2048000/1)
11.0% (.HTP) HomeLab/BraiLab Tape image (256000/1)
0.2% (.ATN) Photoshop Action (5007/6/1)
0.1% (.ISO) ISO 9660 CD image (2545/36/1)
0.0% (.BIN/MACBIN) MacBinary 1 (1033/5)
Magika iso
Reporter FXOLabs
Tags:iso ValleyRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
US US
File Archive Information

This file archive contains 2 file(s), sorted by their relevance:

File name:Open_to_view.exe
File size:25'672 bytes
SHA256 hash: de0b9b6656c9e9fc9db4271610a09c2ae27d07c5a4757e94b2e0314a9dda6ee4
MD5 hash: e6363b8ec386338ce08f159a739f0e97
MIME type:application/x-dosexec
Signature ValleyRAT
File name:winhttp.dll
File size:224'256 bytes
SHA256 hash: c391ba1e1d51219b429ae97b5bfd6bd7e20cd964113d6f05f6c1c068f9a56509
MD5 hash: ab45585a90180b72bcd61d825cef87ca
MIME type:application/x-dosexec
Signature ValleyRAT
Vendor Threat Intelligence
Malware configuration found for:
Archives
Details
Link:
https://research.acce.ciphertechsolutions.com/results/2ce37da0-be51-4c83-af7a-66b1d4121639/
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad630adafb06e650cd7dacd
Tags:
ransomware
Gathering data
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/d7139ffe2d9e04c6ac1df903e0c9236aa7d0561ab5cb78022406bc016cdc4890
Verdict:
inconclusive
YARA:
1 match(es)
Tags:
Executable ISO9660 Image PDB Path PE (Portable Executable) PE File Layout
Link:
https://app.malva.re/file/55d06721b77b449b38f747816564de69
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d7139ffe2d9e04c6ac1df903e0c9236aa7d0561ab5cb78022406bc016cdc4890/
Threat name:
Win64.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-19 15:00:52 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
11 of 36 (30.56%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=24jz77rntycmnla57eb6bsjdnkt5avq2wxfxqarea26ac3g4jcia._file
Result
Malware family:
valleyrat_s2
Create hunting rule
Score:
  10/10
Tags:
family:valleyrat_s2 backdoor defense_evasion discovery execution persistence privilege_escalation ransomware
Link:
https://tria.ge/reports/261019-sjkfqacw9v/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Browser Information Discovery
Direct Volume Access: Opens a physical disk for reading
Executes dropped EXE
Loads dropped DLL
Enumerates connected drives
Command and Scripting Interpreter: PowerShell
Family: ValleyRat
Malware Config
C2 Extraction:
202.146.222.95:443
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d7139ffe2d9e04c6ac1df903e0c9236aa7d0561ab5cb78022406bc016cdc4890

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SUSP_EXE_in_ISO
Create hunting rule
Author:SECUINFRA Falcon Team
Description:Detects ISO files that contains an Exe file. Does not need to be malicious
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

ValleyRAT

iso d7139ffe2d9e04c6ac1df903e0c9236aa7d0561ab5cb78022406bc016cdc4890

(this sample)

  
Delivery method
Distributed via e-mail attachment

Comments