MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e2f034103fee432f5a0d6e79e56f06c9df5d9cb2c6b56ffe4eea85c7213eb4ac. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e2f034103fee432f5a0d6e79e56f06c9df5d9cb2c6b56ffe4eea85c7213eb4ac
SHA3-384 hash:	bb4ffbf34325e7c380e42974ca38e4d779f0337695cc04911438111183a582691a3900393fef48f1a3fc3830b92096ec
SHA1 hash:	abc3176c5abf5dc3cfc0c16d6f8b16125a7bdd74
MD5 hash:	c2a0627fcaf9f749dcfd3bf06a9bdc43
humanhash:	minnesota-angel-foxtrot-triple
File name:	win32-quickq.exe
Download:	download sample
Signature	ValleyRAT Alert Create hunting rule
File size:	102'398'930 bytes
First seen:	2026-08-14 03:07:41 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	2057790ae7855765d51bdc4142e62f9c (54 x RemusStealer, 5 x ValleyRAT, 5 x SalatStealer)
ssdeep	3145728:aB+Jekz2IV5764YhnE65oYDsLqfhSGDILhGXvF4uHw3:aXV8vLesuZSGDFvF43
TLSH	T15D283346E2E9C8FBDA871878899A2B1DF6BB7CF10255ED3702A0339F4D3464A0D5C791
TrID	93.7% (.EXE) WinRAR Self Extracting archive (4.x-5.x) (265042/9/39) 2.3% (.EXE) Win64 Executable (generic) (6522/11/2) 1.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 0.7% (.EXE) OS/2 Executable (generic) (2029/13) 0.7% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	f0c896b28a9ec8f0 (4 x ValleyRAT)
Reporter	aachum
Tags:	203-91-74-4 CHN exe ValleyRAT

iamaachum

https://quickqe.net/apps/?platform=windows => https://quickqe.net/api/download/4

ValleyRAT C2: 203.91.74.4:1231

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

311

Origin country :

ES

Vendor Threat Intelligence

ACCE Rar_SFX

Details

Link:

https://research.acce.ciphertechsolutions.com/results/891a62d3-5219-47bd-a5a6-2c4da05c45e8/

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Searching for the window

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file in the %temp% subdirectories

Creating a process from a recently created file

Creating a process with a hidden window

Launching the default Windows debugger (dwwin.exe)

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug crypto expired-cert fingerprint installer installer installer-heuristic microsoft_visual_cc overlay packed packed reconnaissance sfx

Link:

https://www.filescan.io/uploads/6a7e86b723d37e4240d26beb/reports/7a564622-96cb-4803-8dd8-52220cf1c864/overview

Hybrid Analysis Trojan/AsyncRAT

Verdict:

Malicious

Labled as:

Trojan/AsyncRAT

Link:

https://www.hybrid-analysis.com/sample/e2f034103fee432f5a0d6e79e56f06c9df5d9cb2c6b56ffe4eea85c7213eb4ac

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

exe x64

Link:

https://opentip.kaspersky.com/e2f034103fee432f5a0d6e79e56f06c9df5d9cb2c6b56ffe4eea85c7213eb4ac/results?tab=lookup

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

evad

Score:

40 / 100

Link:

https://www.joesandbox.com/analysis/1958017

Signature

Allocates memory in foreign processes

Benign windows process drops PE files

Changes memory attributes in foreign processes to executable or writable

Found direct / indirect Syscall (likely to bypass EDR)

Multi AV Scanner detection for submitted file

Sample is not signed and drops a device driver

Unusual module load detection (module proxying)

Writes to foreign memory regions

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

74%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/e2f034103fee432f5a0d6e79e56f06c9df5d9cb2c6b56ffe4eea85c7213eb4ac

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Win64.Trojan.Generic

Threat name:

Win64.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-08-14 03:10:39 UTC

File Type:

PE+ (Exe)

Extracted files:

931

AV detection:

12 of 24 (50.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4lydieb75zbs6wqnnz46k3ygzhpv3hfsy22w77so5kc4oij6wswa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

adware defense_evasion discovery execution spyware

Link:

https://tria.ge/reports/260814-dm7m4abn4v/

Behaviour

Kills process with taskkill

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Executes a command shell one-liner

System Location Discovery: System Language Discovery

Checks installed software on the system

Drops desktop.ini file(s)

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.