MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e17d12a3cb758a7cd55d9e0305bc1471d30a7125cb14f3574d47f1bb91216fc4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e17d12a3cb758a7cd55d9e0305bc1471d30a7125cb14f3574d47f1bb91216fc4
SHA3-384 hash: 346411ad96493168bd770a7a156ab3b1e3778920c4a007e167521ced1aef72836a5266639d171ad3f1f0362800488d82
SHA1 hash: d88690194f2f9d6c0f85b675f758b7c9f507c8ef
MD5 hash: 8a439d79b71266e40b932055916c0ce6
humanhash: ink-sixteen-winner-hawaii
File name:letsvpn_v3.5.6_x64.msi
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:21'753'344 bytes
First seen:2026-04-28 10:02:46 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 393216:Ai78bPAgKSR5X6jOhDDcpdZR1Do6AvuC0Fs5GjC75/4y3GlRZC4gfbPQe3HqsU:AGq3H5KlDXC0m/fWlRZQfjnHG
Threatray 526 similar samples on MalwareBazaar
TLSH T1A7273320B28AC032D62E0177F5A8FE1E4A3DBE73476041D773E8B97E48B55C29639617
TrID 79.6% (.MSI) Microsoft Windows Installer (454500/1/170)
10.6% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
0.4% (.ASSETS) Unity binary serialized Assets (generic) (2509/3/1)
Magika msi
Reporter smica83
Tags:msi signed ValleyRAT

Code Signing Certificate

Organisation:MiniTool Software Limited
Issuer:Sectigo Public Code Signing CA EV E36
Algorithm:ecdsa-with-SHA256
Valid from:2026-03-27T00:00:00Z
Valid to:2027-03-26T23:59:59Z
Serial number: 99d8974c1eaa7be996585ff2de10d3ad
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: eed2ac76bd45cc7255b6d4f5708b9c32377b0e303cadda2f8994c56424fa5111
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
137.220.134.149:7799 https://threatfox.abuse.ch/ioc/1801615/

Intelligence

File Origin
# of uploads :
1
# of downloads :
116
Origin country :
HU HU
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/44094b12-08f2-46a7-adaa-fe94dbcecfb3/
Detection:
HijackLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/63852/
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug base64 cmd expired-cert fingerprint lolbin packed short-lived-cert signed update wix
Link:
https://www.filescan.io/uploads/69f0862d3e07376f2fc93b2c/reports/2f9d2c78-ffdf-4dcf-96af-ba69e0889113/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/e17d12a3cb758a7cd55d9e0305bc1471d30a7125cb14f3574d47f1bb91216fc4
Result
Verdict:
UNKNOWN
Link:
https://labs.inquest.net/dfi/sha256/e17d12a3cb758a7cd55d9e0305bc1471d30a7125cb14f3574d47f1bb91216fc4
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
File Type:
msi
First seen:
2026-04-27T11:01:00Z UTC
Last seen:
2026-04-30T04:05:00Z UTC
Hits:
~10
Detections:
Trojan.Win32.Loader.sb Trojan.Win32.Loader.rmg Trojan-PSW.Win32.Coins.sb
Link:
https://opentip.kaspersky.com/e17d12a3cb758a7cd55d9e0305bc1471d30a7125cb14f3574d47f1bb91216fc4/results?tab=lookup
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
3 / 100
Link:
https://www.joesandbox.com/analysis/1905595
Behaviour
Behavior Graph:
n/a
Score:
26%
Verdict:
Benign
File Type:
ARCHIVE
Link:
https://malprob.io/report/e17d12a3cb758a7cd55d9e0305bc1471d30a7125cb14f3574d47f1bb91216fc4
Gathering data
Gathering data
Verdict:
Malicious
Threat:
Trojan.Win32.Loader
Link:
https://tip.neiki.dev/file/e17d12a3cb758a7cd55d9e0305bc1471d30a7125cb14f3574d47f1bb91216fc4
Threat name:
Win32.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-04-27 10:39:50 UTC
File Type:
Binary (Archive)
Extracted files:
861
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4f6rfi6lowfhzvk5tybqlpauohjqu4jfzmkpgv2ni7y3xejbn7ca._file
Verdict:
malicious
Label(s):
valleyrat
Create hunting rule
Similar samples:
00f97d87c7abeaa0f2b075bf1cb9c145d60d3e16bb5f4bc2b4ddbb6db277e43a
ValleyRAT
8b32bca3d93c619f9f6a96eb6c6f14cec3346266815d5edbe0b3d0803240a988
ValleyRAT
b4bdd1910dad1d6647b4120a939505bec6ca35a265e9efc055fcc6c12b52dd5c
ValleyRAT
error
ValleyRAT
fd092975c0cdb940af74e98ad5816bd97108956d8dc04c318cc99ca2f1b69a66
ValleyRAT
+ 516 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery persistence privilege_escalation
Link:
https://tria.ge/reports/260428-l33yvaby4j/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Event Triggered Execution: Installer Packages
System Location Discovery: System Language Discovery
Badlisted process makes network request
Enumerates connected drives
Loads dropped DLL
Malware family:
ValleyRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e17d12a3cb75/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e17d12a3cb758a7cd55d9e0305bc1471d30a7125cb14f3574d47f1bb91216fc4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_MSI_LATAM_Banker_From_LatAm
Create hunting rule
Rule name:Excel_Hidden_Macro_Sheet
Create hunting rule
Rule name:mht_inside_word
Create hunting rule
Author:dPhish
Description:Detect embedded mht files inside microsfot word.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/63852/

Comments