🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fe787eb95026b3e8f6a389f74a2f26e2202b1fada02f603dab173a7d8464d7fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ValleyRAT


Vendor detections: 17


Intelligence 17 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fe787eb95026b3e8f6a389f74a2f26e2202b1fada02f603dab173a7d8464d7fd
SHA3-384 hash: 14bdc2c79c9753298291eb02f486d261476d1752ef25126e5f0cc2a60aee172e1ef827d510ab790b5e56a9c32b894a3e
SHA1 hash: e9e5dcabaeb94592ec7d409163f79ccfc241f737
MD5 hash: af1fb941c33459d2d30efa337da175f7
humanhash: juliet-mike-johnny-delaware
File name:Setup.exe$$
Download: download sample
Signature ValleyRAT
Create hunting rule
File size:28'488'219 bytes
First seen:2026-11-02 09:40:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 5a594319a0d69dbc452e748bcf05892e (32 x Gh0stRAT, 21 x ParallaxRAT, 16 x ValleyRAT)
ssdeep 786432:mLIZBY3hovce05pTeCMpC7G5FYQuiVR1xhEl:nZGGce0LN2CGYQz+l
TLSH T18857333BF265A43FD4664B7289B7A250883B7665B51E8D6F43F0091DCF2A4B01F3B249
TrID 49.2% (.EXE) Inno Setup installer (107240/4/30)
19.7% (.EXE) InstallShield setup (43053/19/16)
19.1% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
3.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
2.9% (.EXE) Win64 Executable (generic) (6522/11/2)
Magika pebin
dhash icon b298acbab2ca7a72 (2'335 x GCleaner, 1'831 x Socks5Systemz, 67 x RedLineStealer)
Reporter ni_fi_701
Tags:exe ValleyRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
251
Origin country :
AT AT
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/b5d16201-979b-46e0-936f-96a0a1f7f062/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/96790/
Verdict:
Malicious
Score:
94.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae85abe38ccdea12c568b6d
Tags:
emotet shell sage blic
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Creating synchronization primitives
Searching for synchronization primitives
Creating a file
Moving a recently created file
Creating a process with a hidden window
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Launching a process
Deleting a recently created file
Loading a suspicious library
Connection attempt
Enabling autorun by creating a file
Unauthorized injection to a system process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context embarcadero_delphi fingerprint inno installer installer installer-heuristic packed reconnaissance
Link:
https://www.filescan.io/uploads/6ae85ab801b8ae92e53d2e24/reports/d059feee-ece0-4904-a90e-d37b6b12e467/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/fe787eb95026b3e8f6a389f74a2f26e2202b1fada02f603dab173a7d8464d7fd
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-11-02T07:53:00Z UTC
Last seen:
2026-11-04T04:22:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/fe787eb95026b3e8f6a389f74a2f26e2202b1fada02f603dab173a7d8464d7fd/results?tab=lookup
Result
Threat name:
ValleyRAT
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
94 / 100
Link:
https://www.joesandbox.com/analysis/1996611
Signature
Antivirus detection for dropped file
Bypasses PowerShell execution policy
C2 URLs / IPs found in malware configuration
Compiles code for process injection (via .Net compiler)
Connects to many ports of the same IP (likely port scanning)
Contains functionality to capture and log keystrokes
Contains functionality to inject code into remote processes
Contains functionality to inject threads in other processes
Creates files in the system32 config directory
Found direct / indirect Syscall (likely to bypass EDR)
Found malware configuration
Hides threads from debuggers
Injects code into the Windows Explorer (explorer.exe)
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
PE file contains section with special chars
Queues an APC in another process (thread injection)
Sigma detected: Dot net compiler compiles file from suspicious location
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Suricata IDS alerts for network traffic
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Unusual module load detection (module proxying)
Writes to foreign memory regions
Yara detected ValleyRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1996611 Sample: Setup.exe$$.exe Startdate: 02/11/2026 Architecture: WINDOWS Score: 94 63 Suricata IDS alerts for network traffic 2->63 65 Found malware configuration 2->65 67 Antivirus detection for dropped file 2->67 69 9 other signatures 2->69 9 Setup.exe$$.exe 2 2->9         started        12 Night.exe 2->12         started        16 BlizzardBrowser.exe 2->16         started        18 explorer.exe 2->18 injected process3 dnsIp4 55 C:\Users\user\AppData\...\Setup.exe$$.tmp, PE32 9->55 dropped 20 Setup.exe$$.tmp 5 28 9->20         started        61 27.124.4.34, 49717, 49718, 49719 CTGSERVERLIMITED-AS-APCTGServerLimitedHK Hong Kong SAR China 12->61 89 Tries to detect sandboxes and other dynamic analysis tools (window names) 12->89 91 Contains functionality to inject threads in other processes 12->91 93 Contains functionality to capture and log keystrokes 12->93 99 5 other signatures 12->99 24 powershell.exe 45 16->24         started        95 System process connects to network (likely due to code injection or exploit) 18->95 97 Unusual module load detection (module proxying) 18->97 file5 signatures6 process7 file8 45 C:\path\to\mcore.dll (copy), PE32+ 20->45 dropped 47 C:\path\to\libcef.dll (copy), PE32+ 20->47 dropped 49 C:\path\to\is-US5MP.tmp, PE32+ 20->49 dropped 53 15 other malicious files 20->53 dropped 71 Suspicious powershell command line found 20->71 73 Bypasses PowerShell execution policy 20->73 26 powershell.exe 45 20->26         started        51 C:\Windows\Temp\akovkssx\akovkssx.0.cs, Unicode 24->51 dropped 75 Creates files in the system32 config directory 24->75 77 Injects code into the Windows Explorer (explorer.exe) 24->77 79 Writes to foreign memory regions 24->79 30 csc.exe 24->30         started        32 conhost.exe 24->32         started        signatures9 process10 file11 57 C:\Users\user\AppData\...\de1rp501.cmdline, Unicode 26->57 dropped 81 Injects code into the Windows Explorer (explorer.exe) 26->81 83 Writes to foreign memory regions 26->83 85 Compiles code for process injection (via .Net compiler) 26->85 87 Queues an APC in another process (thread injection) 26->87 34 csc.exe 26->34         started        37 conhost.exe 26->37         started        59 C:\Windows\Temp\akovkssx\akovkssx.dll, PE32 30->59 dropped 39 cvtres.exe 30->39         started        signatures12 process13 file14 43 C:\Users\user\AppData\Local\...\de1rp501.dll, PE32 34->43 dropped 41 cvtres.exe 34->41         started        process15
Score:
41%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/fe787eb95026b3e8f6a389f74a2f26e2202b1fada02f603dab173a7d8464d7fd
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/af1fb941c33459d2d30efa337da175f7
Gathering data
Threat name:
Win32.Trojan.DllHijack
Create hunting rule
Status:
Suspicious
First seen:
2026-11-02 09:41:22 UTC
File Type:
PE (Exe)
Extracted files:
463
AV detection:
9 of 38 (23.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7z4h5okqe2z6r5vdrh3uulzg4iqcwh5nuaxwapnlc45h3bde276q._file
Verdict:
malicious
Label(s):
ValleyRAT
Create hunting rule
Link:
https://reports.threatray.com/aac282eb-8686-4de7-9575-eb05c226b2d3
Result
Malware family:
valleyrat_s2
Create hunting rule
Score:
  10/10
Tags:
family:valleyrat_s2 backdoor discovery execution installer persistence ransomware
Link:
https://tria.ge/reports/261102-lnwk8at19l/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of WriteProcessMemory
Uses Task Scheduler COM API
Uses Volume Shadow Copy WMI provider
Uses Volume Shadow Copy service COM API
Inno Setup is an open-source installation builder for Windows applications.
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in System32 directory
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Command and Scripting Interpreter: PowerShell
Detects ValleyRAT payload
Family: ValleyRat
Malware Config
C2 Extraction:
192.168.1.200:9999
27.124.4.34:62841
Malware Family:
n/a
Verdict:
Malicious
Tags:
n/a
YARA:
win_token
Link:
https://app.threat.zone/submission/fb230e3c-c779-4a9f-a097-e5634db98505
Malware Family:
xkcp
Create hunting rule
Malicious:
True
Tags:
detect-debug-environment malware macro-powershell checks-network-adapters overlay long-sleeps calls-wmi obfuscated self-delete
Link:
https://intel.virussign.com/intelligence/file/fe787eb95026b3e8f6a389f74a2f26e2202b1fada02f603dab173a7d8464d7fd
Malware family:
ValleyRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/fe787eb95026/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/fe787eb95026b3e8f6a389f74a2f26e2202b1fada02f603dab173a7d8464d7fd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:MULTI_Malware_AgentTesla_ForgeAuto_ed343f78_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects AgentTesla (inconnu, etat extrait)
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:WIN_Malware_Unknown_ForgeAuto_1708427c_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_4ab123d7_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_6422f546_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_f5d58a9e_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/96790/

Comments