MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e6f4c46f2a72a4d8b1eda2c2c431c64d73eae7057221b35a6fc16138e4dc4d43. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 13


Intelligence 13 IOCs 1 YARA 44 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e6f4c46f2a72a4d8b1eda2c2c431c64d73eae7057221b35a6fc16138e4dc4d43
SHA3-384 hash: c97ae0708c750760959eb23c491268b69f940b5e862189307c8157380962d52b853e9b34480bee535399a4327b8b46d2
SHA1 hash: 602862693c2edba1df17afd61b4fcdc3a5ca139f
MD5 hash: 0561a3921c93fe5913454241362e80e2
humanhash: nitrogen-fanta-september-september
File name:DingTalkD_Setup2026.exe
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:44'304'324 bytes
First seen:2026-07-19 23:10:26 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 40ab50289f7ef5fae60801f88d4541fc (77 x ValleyRAT, 58 x Gh0stRAT, 42 x OffLoader)
ssdeep 786432:LhGfMHhij2MOLPstwdk0dyRFsNBvkOPFkFFQB7msB/PZkl4h2r6HWeyZpy0bfiGs:LhGfMBijDO0rs0OPBysNxklDrvpy0bf6
TLSH T1F7A73323B3C7A13FF45E0B3B16B3A16094FB9A11B512BD678AC440ECDE264541E7E61B
TrID 63.8% (.EXE) Inno Setup installer (107240/4/30)
24.7% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
3.8% (.EXE) Win64 Executable (generic) (6522/11/2)
2.6% (.EXE) Win32 Executable (generic) (4504/4/1)
1.2% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
dhash icon c488b8f0e2b692cc (4 x ValleyRAT, 3 x Gh0stRAT, 2 x CobaltStrike)
Reporter Ling
Tags:exe SilverFox ValleyRAT


Avatar
CNGaoLing
The sample is retrieved from "https://i-dingtalk.com.cn" / "https://pc.s-dingtalk.com.cn" / "https://o-dingtalk.com.cn" / "https://v-dingtalk.com.cn"
Note: The malicious redirection only triggers when the link is clicked directly from Bing search results.

SilverFox
IOC (IP 192.197.113.54:332)

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
192.197.113.54:332 https://threatfox.abuse.ch/ioc/1853967/

Intelligence

File Origin
# of uploads :
1
# of downloads :
185
Origin country :
US US
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/f3b3d8f3-d5fc-4625-802f-fccb70e5ff1b/
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a5d597885479d70bfb779d9
Tags:
shellcode dropper emotet smtp
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
Creating a file in the %AppData% subdirectories
Moving a file to the %AppData% subdirectory
Deleting a recently created file
Connection attempt
Sending a custom TCP request
Replacing files
DNS request
Creating a file
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Enabling autorun by creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug base64 crypto embarcadero_delphi evasive expired-cert fingerprint inno installer installer installer-heuristic lolbin msiexec packed packed reconnaissance
Link:
https://www.filescan.io/uploads/6a5d596eda6a306167dbe352/reports/0fa85f16-4ac1-4f40-9325-4d6af962ede9/overview
Verdict:
Malicious
Labled as:
VHO:TrojanDrop.Convagent.gen
Link:
https://www.hybrid-analysis.com/sample/e6f4c46f2a72a4d8b1eda2c2c431c64d73eae7057221b35a6fc16138e4dc4d43
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-19T20:00:00Z UTC
Last seen:
2026-07-20T09:52:00Z UTC
Hits:
~100
Detections:
HEUR:Trojan.Win32.DLLhijack.gen Backdoor.Win32.Xkcp.a PDM:Trojan.Win32.Generic Backdoor.Agent.TCP.C&C
Link:
https://opentip.kaspersky.com/e6f4c46f2a72a4d8b1eda2c2c431c64d73eae7057221b35a6fc16138e4dc4d43/results?tab=lookup
Score:
78%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e6f4c46f2a72a4d8b1eda2c2c431c64d73eae7057221b35a6fc16138e4dc4d43
Gathering data
Threat name:
Win32.Trojan.ValleyRAT
Create hunting rule
Status:
Malicious
First seen:
2026-07-19 23:11:35 UTC
File Type:
PE (Exe)
Extracted files:
3250
AV detection:
17 of 38 (44.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=432mi3zkoksnrmpnulbmimogjvz6vzyfoiq3gwtpyfqtrzg4jvbq._file
Verdict:
malicious
Label(s):
ValleyRAT
Create hunting rule
Link:
https://reports.threatray.com/2bcc60f0-8f77-49d7-9be1-74c633e25fc7
Similar samples:
0953e4227c3f8a5a834fa821fd542a1c948dab9aacbb4e2f7b494fedf98a1ba1
ValleyRAT
319003deff1bed6114aba4f16891f603976834d0b9fbba04df15c514c57ecd86
ValleyRAT
94410509bb5ff92426768ce7bb5b85f85680e556cc2563ebc37776b092710a6e
ValleyRAT
9e1b6b07c4e770a811fe6922c7f7cb56273c28cf37379ccba8ddaf632b87f401
ValleyRAT
a1b42e76b010abae4045778af383080c69e9018c5bb90b6b40dbdb2de7100bb9
ValleyRAT
bb1cb60ff6eeb6009668354fe7af609a5495d1aa8998582f8e819dedce833930
ValleyRAT
e31d446c7b1f28b034ba1cdf43522c598ab670f8a706a048b4be68bdb2492487
ValleyRAT
e6f4c46f2a72a4d8b1eda2c2c431c64d73eae7057221b35a6fc16138e4dc4d43
ValleyRAT
Result
Malware family:
valleyrat_s2
Create hunting rule
Score:
  10/10
Tags:
family:valleyrat_s2 backdoor discovery installer persistence upx
Link:
https://tria.ge/reports/260719-26ecnafs3p/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
Enumerates physical storage devices
Program crash
System Location Discovery: System Language Discovery
UPX packed file
Adds Run key to start application
Checks installed software on the system
Enumerates connected drives
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Detects ValleyRAT payload
Family: ValleyRat
Malware Config
C2 Extraction:
192.197.113.54:332
127.0.0.1:80
Malware family:
ValleyRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/e6f4c46f2a72/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Agent_BTZ
Create hunting rule
Rule name:BLOWFISH_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for Blowfish constants
Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:ComRAT
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:FormhookB
Create hunting rule
Author:kevoreilly
Description:Formbook Anti-hook Bypass
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:GenericGh0st
Create hunting rule
Author:Still
Rule name:Gh0stKCP
Create hunting rule
Author:Netresec
Description:Detects HP-Socket ARQ and KCP implementations, which are used in Gh0stKCP. Forked from @stvemillertime's KCP catchall rule.
Reference:https://netresec.com/?b=259a5af
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:MAL_packer_lb_was_detected
Create hunting rule
Author:0x0d4y
Description:Detect the packer used by Lockbit4.0
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_peb_parsing
Create hunting rule
Author:Willi Ballenthin
Rule name:OpCloudHopper_Malware_3
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects malware from Operation Cloud Hopper
Reference:https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html
Rule name:OpCloudHopper_Malware_3_RID2FEF
Create hunting rule
Author:Florian Roth
Description:Detects Operation CloudHopper malware samples
Reference:https://www.pwc.co.uk/issues/cyber-security-data-privacy/insights/operation-cloud-hopper.html
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:ThreadControl__Context
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:UPX
Create hunting rule
Author:kevoreilly
Description:UPX Unpacker: dump on OEP (original entry point)
Rule name:upx_largefile
Create hunting rule
Author:k3nr9
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:WHIRLPOOL_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for WhirlPool constants
Rule name:Windows_Generic_Threat_4b0b73ce
Create hunting rule
Author:Elastic Security
Rule name:WinosStager
Create hunting rule
Author:YungBinary
Description:https://www.esentire.com/blog/winos4-0-online-module-staging-component-used-in-cleversoar-campaign
Rule name:Win_FakeInstaller_PythonShellcodeLoader_Crepectl_2026
Create hunting rule
Author:SixHands
Description:Detects the analyzed fake installer sample using .key config, XOR key, and Python/fiber shellcode loader traits
Rule name:win_winos_auto
Create hunting rule
Author:Felix Bilstein - yara-signator at cocacoding dot com
Description:Detects win.winos.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ValleyRAT

Executable exe e6f4c46f2a72a4d8b1eda2c2c431c64d73eae7057221b35a6fc16138e4dc4d43

(this sample)

  
Delivery method
Distributed via web download

Comments