MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dfbbc455accdfce3fbbd3261a556876adcbff056ceddf48a231c59e0ef920827. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	dfbbc455accdfce3fbbd3261a556876adcbff056ceddf48a231c59e0ef920827
SHA3-384 hash:	28aa8377aaf386a82434791ce86e37aaa2580a3f14dd7ad2e0d73a6f67527a237420baa0184567abbfd6e9aff8f7edc3
SHA1 hash:	433663bb3bc247d174e46b37ce68d1f0d136f261
MD5 hash:	216b2a4a642e3f1a9167d236c391a71b
humanhash:	minnesota-asparagus-oscar-steak
File name:	3.6.0.Safewin_chfy_PIAX_v0.1.2.exe
Download:	download sample
Signature	ValleyRAT Alert Create hunting rule
File size:	97'503'964 bytes
First seen:	2026-07-27 10:09:35 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	1c8abb0d55065ed8370628959ce78804 (5 x ValleyRAT)
ssdeep	1572864:2XqgR72V+46pH7nockiRncKjtO6tTr9MwZYSrl2yu8U3nOw8oq4UOGmlhwY:n472Vy7citZt9ME32yup318MN
TLSH	T1462833BF2298D61BE29CC13BD5A39F90B533B0750B23CAD799A502A4EA435C55F7E310
TrID	51.8% (.EXE) Win64 Executable (generic) (6522/11/2) 16.1% (.EXE) OS/2 Executable (generic) (2029/13) 15.9% (.EXE) Generic Win/DOS Executable (2002/3) 15.8% (.EXE) DOS Executable (generic) (2000/1) 0.2% (.VXD) VXD Driver (29/21)
Magika	pebin
dhash icon	71f8cccccc82cccc (1 x ValleyRAT)
Reporter	Ling
Tags:	exe SilverFox ValleyRAT

CNGaoLing

SilverFox
IOC (IP 137.220.136.168:5178)

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

158

Origin country :

US

Vendor Threat Intelligence

ACCE Inno_Setup

Details

Link:

https://research.acce.ciphertechsolutions.com/results/f067d768-808f-480a-8364-772fc184bdc6/

ANY.RUN

Malware family:

n/a

ID:

1

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-07-27 10:20:23 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/94917442-6513-443a-a739-efcf6b5a42f8

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a window

Creating a process from a recently created file

Сreating synchronization primitives

Searching for synchronization primitives

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-vm crypto embarcadero_delphi expired-cert fingerprint inno installer installer installer-heuristic invalid-signature packed reconnaissance signed

Link:

https://www.filescan.io/uploads/6a672ec61baa46a4c3e17c79/reports/d51482a4-e65c-4ca4-a90e-40ee0fa30144/overview

Hybrid Analysis Trojan.Win64.Generic.oa

Verdict:

Malicious

Labled as:

Trojan.Win64.Generic.oa

Link:

https://www.hybrid-analysis.com/sample/dfbbc455accdfce3fbbd3261a556876adcbff056ceddf48a231c59e0ef920827

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-07-27T02:14:00Z UTC

Last seen:

2026-07-29T07:03:00Z UTC

Hits:

~100

Detections:

Trojan.Win32.Shellcode.sb Trojan.Win32.Autorun.sb BSS:Trojan.Win32.Generic Trojan.Win32.Inject.sb Trojan.Win32.Agent.sb Trojan.Multi.Agent.au Trojan.Win64.Agent.sb Trojan.Win64.Agent.smgtrk Trojan.Win64.Agentb.lkte

Link:

https://opentip.kaspersky.com/dfbbc455accdfce3fbbd3261a556876adcbff056ceddf48a231c59e0ef920827/results?tab=lookup

Nucleon Malprob Benign

Score:

25%

Verdict:

Benign

File Type:

PE

Link:

https://malprob.io/report/dfbbc455accdfce3fbbd3261a556876adcbff056ceddf48a231c59e0ef920827

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win64.Exploit.DonutMarte

Threat name:

Win64.Exploit.DonutMarte

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-27 07:05:16 UTC

File Type:

PE+ (Exe)

AV detection:

4 of 36 (11.11%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3654ivnmzx6oh655gjq2kvuhnlol74cwz3o7jcrddrm6b34sbatq._file

Threatray DonutLoader

Verdict:

malicious

Label(s):

DonutLoader

Alert

Create hunting rule

Link:

https://reports.threatray.com/5f07eb13-85e5-40a3-86f2-98512ebe416d

Similar samples:

0d00dcc777435cb0f17207ab832acdb1079998715bdda4df70233d4e8c98fb7f

ValleyRAT

7ba07adbdb86eafd252678c037fd1a59c15400ca5c38426cb5dce4030f1c7b7d

ValleyRAT

7d9eecfd59ed832823168e26b60dab4c96974afb57711b4762ddf662454ed963

ValleyRAT

d6a84954e038ddf4a0026705e0942fc003cfdc04e58f658a6bd9e89c37c57d18

ValleyRAT

dfbbc455accdfce3fbbd3261a556876adcbff056ceddf48a231c59e0ef920827

ValleyRAT

e70179810f8c851e20966da1e5e1bb45dfc603c068864192c43eb161ce7abbd9

ValleyRAT

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

installer

Link:

https://tria.ge/reports/260727-l697bsad35/

Behaviour

Suspicious use of WriteProcessMemory

Inno Setup is an open-source installation builder for Windows applications.

Executes dropped EXE

Loads dropped DLL

VMRay DonutLoader

Malware family:

DonutLoader

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/dfbbc455accd/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/dfbbc455accdfce3fbbd3261a556876adcbff056ceddf48a231c59e0ef920827