MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4c45b94663e791fbb7d84b6eabec26f7bdef921f7bafe72934f00f2bc0259a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ValleyRAT

Vendor detections: 7

Intelligence 7 IOCs YARA 6 File information Comments

SHA256 hash:	f4c45b94663e791fbb7d84b6eabec26f7bdef921f7bafe72934f00f2bc0259a8
SHA3-384 hash:	71dfc667f6425d3d983e7a79d402f068c57cce8fec3507625c6f14d843dd266dd547f44fb5c5d39fef9785de32a3e2aa
SHA1 hash:	6c56483e8333e58f3ceb208a7de9ec158a0ab56c
MD5 hash:	3bfe9cbc18aa1687a59f761efe236ea7
humanhash:	september-august-romeo-idaho
File name:	DeepLSetup (7).msi
Download:	download sample
Signature	ValleyRAT Create hunting rule
File size:	57'355'776 bytes
First seen:	2025-08-13 05:26:33 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	1572864:6t/OuBGxFHS5n9ClPXYj2wC8rigxJFL3bxg4j:+OegFC9CqCti/tg
TLSH	T1A0C73324B17269D4E62FA7BFE0A95FC44430BCE1731BE66773783FA589B064611B2903
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	GDHJDSYDH1
Tags:	backdoor dropper Gh0stRAT msi SilverFox ValleyRAT

GDHJDSYDH1

C2:
103.235.46.115:443
27.124.21.207:5178
Reference:
https://hunting.abuse.ch/hunt/103.235.46.115/#sandnet

Intelligence

File Origin

# of uploads :

# of downloads :

229

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=689c2245642b4839d1b5acaa

Tags:

virus spawn

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

cmd lolbin obfuscated remote wix

Link:

https://www.filescan.io/uploads/689c223f2fbe0788fb1ec495/reports/78280199-8c2c-4cc3-a537-343c5cdeb949/overview

Verdict:

Suspicious

Link:

https://www.hybrid-analysis.com/sample/f4c45b94663e791fbb7d84b6eabec26f7bdef921f7bafe72934f00f2bc0259a8

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/f4c45b94663e791fbb7d84b6eabec26f7bdef921f7bafe72934f00f2bc0259a8

Score:

Verdict:

Benign

File Type:

Result

Malware family:

n/a

Score:

6/10

Tags:

discovery

Link:

https://tria.ge/reports/250813-f5mrrafl6y/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Loads dropped DLL

Enumerates connected drives

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/a9e4531c-ec59-46f4-b226-13e5aa81290f

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	botnet_plaintext_c2 Create hunting rule
Author:	cip
Description:	Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Detect_MSI_LATAM_Banker_From_LatAm Create hunting rule

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)