MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f31f25df2482de053668626c602a16ae43962b81fe3c3a5892468666bcfb0aa0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 8 File information Comments 1
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f31f25df2482de053668626c602a16ae43962b81fe3c3a5892468666bcfb0aa0
SHA3-384 hash: 5e7b5abb381dfe9e0e40625ac5086ad200c0ed34131fcdccf183e812e33e4d9987f10c2f540a4de1871c64af2fe66eba
SHA1 hash: 742197751218ff23a67aa41cb3ff3c90d4908138
MD5 hash: aefc72a606ef895b1e7b6dc962551056
humanhash: johnny-ohio-three-tango
File name:fs_setup.exe
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:8'759'109 bytes
First seen:2025-06-23 21:30:50 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c990338f8145dc29c6f38fb73cf05c77 (58 x BlankGrabber, 7 x PythonStealer, 5 x DiscordTokenStealer)
ssdeep 196608:HIVxO4JQurHhm8NlOQPAv2j52C90Vzd3:oVxOOQuQ8Sk200b
TLSH T11A9633047AE445DFFAEA863DC8434E09E379B9363394C65B13A8C6911E373D06929FB1
TrID 66.6% (.EXE) InstallShield setup (43053/19/16)
16.2% (.EXE) Win64 Executable (generic) (10522/11/4)
7.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
3.1% (.EXE) OS/2 Executable (generic) (2029/13)
3.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon c6c2ccc4f4e0e0f8 (37 x PythonStealer, 21 x CrealStealer, 19 x Empyrean)
Reporter GDHJDSYDH1
Tags:exe FakeApp injector kryptik pyinstaller SilverFox ValleyRAT


Avatar
GDHJDSYDH1
C2: 61.129.168.13:13580
Domain: wzgl.yjglj.sh.gov.cn

Intelligence

File Origin
# of uploads :
1
# of downloads :
389
Origin country :
US US
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
fs_setup.exe
Verdict:
Malicious activity
Analysis date:
2025-06-23 21:23:32 UTC
Tags:
python pyinstaller advancedinstaller
Link:
https://app.any.run/tasks/9ecfd50a-7d14-4c02-8dab-c1a5666b095a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/10724/
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6859c8aeb06783b9ebd6c0ce
Tags:
installer extens blic
Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Restart of the analyzed sample
Creating a window
Creating a file
Launching a process
Сreating synchronization primitives
Modifying a system file
Creating a file in the Windows subdirectories
Creating a file in the %AppData% subdirectories
DNS request
Connection attempt
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
expand lolbin microsoft_visual_cc overlay overlay packed packed packer_detected
Link:
https://www.filescan.io/uploads/6859c856cf2af1571115c0cc/reports/865bb2f7-0c37-48e6-a34f-0b7025e4ec65/overview
Verdict:
Malicious
Labled as:
RiskWare/Kryptik.a
Link:
https://www.hybrid-analysis.com/sample/f31f25df2482de053668626c602a16ae43962b81fe3c3a5892468666bcfb0aa0
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/3e1bd037-45fc-42ac-956d-c41dbf5647e6
Result
Threat name:
n/a
Detection:
malicious
Classification:
troj
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1721275
Signature
Connects to many ports of the same IP (likely port scanning)
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1721275 Sample: fs_setup.exe Startdate: 23/06/2025 Architecture: WINDOWS Score: 52 38 wzgl.yjglj.sh.gov.cn 2->38 42 Multi AV Scanner detection for submitted file 2->42 44 Connects to many ports of the same IP (likely port scanning) 2->44 8 msiexec.exe 14 40 2->8         started        11 fs_setup.exe 53 2->11         started        signatures3 process4 file5 22 C:\Windows\Installer\MSI660F.tmp, PE32+ 8->22 dropped 24 C:\Windows\Installer\MSI4ECC.tmp, PE32 8->24 dropped 26 C:\Windows\Installer\MSI4E9C.tmp, PE32 8->26 dropped 34 3 other malicious files 8->34 dropped 13 msiexec.exe 6 8->13         started        16 msiexec.exe 8->16         started        28 C:\Users\user\AppData\...\unicodedata.pyd, PE32+ 11->28 dropped 30 C:\Users\user\AppData\Local\...\ucrtbase.dll, PE32+ 11->30 dropped 32 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 11->32 dropped 36 47 other files (none is malicious) 11->36 dropped 18 fs_setup.exe 3 11->18         started        process6 dnsIp7 40 wzgl.yjglj.sh.gov.cn 61.129.168.13, 13580, 49681 CHINANET-SH-APChinaTelecomGroupCN China 13->40 20 msiexec.exe 18->20         started        process8
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/f31f25df2482de053668626c602a16ae43962b81fe3c3a5892468666bcfb0aa0
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) Win 64 Exe x64
Link:
https://app.malva.re/file/aefc72a606ef895b1e7b6dc962551056
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f31f25df2482de053668626c602a16ae43962b81fe3c3a5892468666bcfb0aa0/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/f31f25df2482de053668626c602a16ae43962b81fe3c3a5892468666bcfb0aa0
Threat name:
Win64.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2025-06-23 15:29:22 UTC
File Type:
PE+ (Exe)
Extracted files:
533
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6mpslxzeqlpakntimjwgakqwvzbzmk4b7y6duwesi2dgnph3bkqa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery pyinstaller
Link:
https://tria.ge/reports/250623-1en74swsew/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Drops file in Windows directory
Blocklisted process makes network request
Enumerates connected drives
Loads dropped DLL
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/1867f4a9-87f8-4209-a10c-e58549031e23
Unpacked files
SH256 hash:
f31f25df2482de053668626c602a16ae43962b81fe3c3a5892468666bcfb0aa0
MD5 hash:
aefc72a606ef895b1e7b6dc962551056
SHA1 hash:
742197751218ff23a67aa41cb3ff3c90d4908138
Link:
https://www.unpac.me/results/e8918c10-dbc1-4dbe-854b-15e3d5493096/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/f31f25df2482de053668626c602a16ae43962b81fe3c3a5892468666bcfb0aa0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:botnet_plaintext_c2
Create hunting rule
Author:cip
Description:Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Detect_PyInstaller
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects PyInstaller compiled executables across platforms
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller. This rule by itself does NOT necessarily mean the detected file is malicious.
Rule name:Sus_Obf_Enc_Spoof_Hide_PE
Create hunting rule
Author:XiAnzheng
Description:Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ValleyRAT

Executable exe f31f25df2482de053668626c602a16ae43962b81fe3c3a5892468666bcfb0aa0

(this sample)

anyrun
any.run
https://app.any.run/tasks/9ecfd50a-7d14-4c02-8dab-c1a5666b095a
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/10724/

Comments


Avatar
commented on 2025-06-23 22:04:18 UTC

C2: 61.129.168.13:13580
Domain: wzgl.yjglj.sh.gov.cn
Detected Family: ValleyRat.C2
Reference: https://hunting.abuse.ch/hunt/wzgl.yjglj.sh.gov.cn/#sandnet