MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e740c1e601f2ae8d43909fe24b43e4c01e2be700298ab75f6ef6460eb5d4509e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e740c1e601f2ae8d43909fe24b43e4c01e2be700298ab75f6ef6460eb5d4509e
SHA3-384 hash: 36d7d906603843a97c6f363a89da6cbba7d70490e5e19b881207d0872ba5d34378932862dd05d1de17798f6309545c8a
SHA1 hash: 3a23596f4822d61944f9aef03b7e5e5599ee68be
MD5 hash: 5aee90d119558f3c43c222ac86071f2b
humanhash: friend-mango-network-magazine
File name:intall_app.66553006.msi
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:9'461'760 bytes
First seen:2026-07-17 08:57:46 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 196608:X/mVqb0fG86ytX2jSxZrS9wl/kvB5xLWW+xOr5wQxLob/Rk4HmwPTE:PmVqbn86yZ23vHxa2qQQu
TLSH T12B9633C4FC8A7F74D547D7B49052746EBC3A3FD4B9A29E0B7A84BA001D732254A7B248
TrID 88.4% (.MST) Windows SDK Setup Transform script (61000/1/5)
11.5% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter Ling
Tags:msi SilverFox ValleyRAT


Avatar
CNGaoLing
The sample is retrieved from "https://www.rubne1877.com/setup18"

SilverFox
IOC (Domain rqrjpl.net) (Domain 7new14.oss-cn-beijing.aliyuncs.com) (Domain 26nn.oss-cn-hangzhou.aliyuncs.com)

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
MSI
Details
Link:
https://research.acce.ciphertechsolutions.com/results/359578e3-9d2c-4719-85a8-7018c97e5b6b/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/74975/
Detection(s):
SecuriteInfo.com.FileRepMalware.19978391.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a59ef2e56bd89099b557dc5
Tags:
n/a
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
CAB installer installer overlay packed packed persistence wix
Link:
https://www.filescan.io/uploads/6a59eec5c834b6eeec45b7b9/reports/9b271d67-dfc1-47f5-b8cc-7a008cc1fd3c/overview
Verdict:
Malicious
Labled as:
Ransomware/Magniber.XG90
Link:
https://www.hybrid-analysis.com/sample/e740c1e601f2ae8d43909fe24b43e4c01e2be700298ab75f6ef6460eb5d4509e
Verdict:
Malicious
File Type:
msi
First seen:
2026-07-17T05:53:00Z UTC
Last seen:
2026-07-17T13:03:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan.Win32.Convagent.gen HackTool.Multi.AmsiETWPatch.sb Trojan.Win32.Agent.sba Trojan.Win32.Zapchast.bpbc Trojan.Win32.Zapchast.bpbb not-a-virus:HEUR:RiskTool.Win32.EvadeAV.gen Trojan-Banker.Win32.Emotet.gppg HEUR:HackTool.OLE2.AmsiETWPatch.gen
Link:
https://opentip.kaspersky.com/e740c1e601f2ae8d43909fe24b43e4c01e2be700298ab75f6ef6460eb5d4509e/results?tab=lookup
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
CAB:COMPRESSION:LZX Executable Office Document PE (Portable Executable) PE File Layout
Link:
https://app.malva.re/file/5aee90d119558f3c43c222ac86071f2b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e740c1e601f2ae8d43909fe24b43e4c01e2be700298ab75f6ef6460eb5d4509e/
Threat name:
Win64.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-07-17 08:59:39 UTC
File Type:
Binary (Archive)
Extracted files:
3
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=45amdzqb6kxi2q4qt7rewq7eyapcxzyafgflox3o6zda5noukcpa._file
Verdict:
malicious
Label(s):
SWORDLDR
Create hunting rule
Link:
https://reports.threatray.com/9859d2b1-ee39-4de7-bbff-09550a52a65d
Result
Malware family:
n/a
Score:
  9/10
Tags:
defense_evasion persistence privilege_escalation ransomware
Link:
https://tria.ge/reports/260717-kxhv2sf12r/
Behaviour
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: LoadsDriver
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy service COM API
Event Triggered Execution: Installer Packages
Drops file in Windows directory
Drops file in System32 directory
Badlisted process makes network request
Enumerates connected drives
Indicator Removal: Clear Persistence
Executes dropped EXE
Loads dropped DLL
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e740c1e601f2ae8d43909fe24b43e4c01e2be700298ab75f6ef6460eb5d4509e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ValleyRAT

Microsoft Software Installer (MSI) msi e740c1e601f2ae8d43909fe24b43e4c01e2be700298ab75f6ef6460eb5d4509e

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/74975/

Comments