MB-931ce3beac7484c2bab59eb90ee0b8230823a2f7b0dbfd6ffd4296767b0640b8
high
📛 Threat Title
ValleyRAT: 47A4F35908F85C4A3FBE536341989D7A.dll
Description
File type: dll. Size: 341504 bytes. Tags: dll, RAT, ValleyRAT. Reporter: abuse_ch. First seen: 2026-08-04 21:45:24.
Indicators of Compromise (4)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
931ce3beac7484c2bab59eb90ee0b8230823a2f7b0dbfd6ffd4296767b0640b8
IOC database
- Type
- hash_sha256
- Value
931ce3beac7484c2bab59eb90ee0b8230823a2f7b0dbfd6ffd4296767b0640b8- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- ValleyRAT
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
6c05f1d4a1d5ab6414f2df877978cf253c2f2d30
IOC database
- Type
- hash_sha1
- Value
6c05f1d4a1d5ab6414f2df877978cf253c2f2d30- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
47a4f35908f85c4a3fbe536341989d7a
IOC database
- Type
- hash_md5
- Value
47a4f35908f85c4a3fbe536341989d7a- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_imphash
3d78bbe1faa6a6dae6c4cb9020627809
IOC database
- Type
- hash_imphash
- Value
3d78bbe1faa6a6dae6c4cb9020627809- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: dll. Size: 341504 bytes. Tags: dll, RAT, ValleyRAT. Reporter: abuse_ch. First seen: 2026-08-04 21:45:24.
Remediations (10)
-
web:any.run
ValleyRAT is a malware used for attacking government organizations, important supply chains, and corporations.
-
web:bazaar.abuse.ch
ValleyRAT malware samples MalwareBazaar Database MalwareBazaar tries to identify the malware family (signature) of submitted malware samples. A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as ValleyRAT . Database Entry
-
web:cyberpress.org
The ValleyRAT_S2 campaign uses covert malware to extract financial information from infected systems, researchers warn.
-
web:cybersecuritynews.com
ValleyRAT malware is spread via fake LINE installers, targeting Chinese users with stealthy loaders to steal credentials and evade detection.
-
web:gbhackers.com
A recent surge in ValleyRAT activity that combines RC4-encrypted payloads, Donut-generated shellcode, and in-memory execution via suspended rundll32 processes to evade detection.
-
web:research.checkpoint.com
The ValleyRAT rootkit module is embedded inside one of the "main" plugins, originally named 驱动插件 (EN: Driver Plugin.dll). This plugin is compiled in both 32-bit and 64-bit variants and acts as the user-mode client and installer for the rootkit.
-
web:www.cybereason.com
In this Threat Analysis Report, Cybereason explores the fake installer, ValleyRAT
-
web:www.pcrisk.com
ValleyRAT can drop and execute Dynamic Link Library (DLL) files and other types of files on the compromised system. This capability lets the malware execute code or applications of its choice, which could include additional malicious payloads (e.g., ransomware or cryptocurrency miners) or tools.
-
web:www.picussecurity.com
ValleyRAT is a multi-stage Windows remote-access trojan (RAT) first observed in early 2023 and now linked to focused campaigns targeting Chinese-language users and organizations. Operators deliver staged components (downloader → loader → injector → RAT) via phishing or trojanized installers, and rely on in-memory decryption and living-off-the-land execution (notably MSBuild.exe) to ...
-
web:www.zscaler.com
Zscaler ThreatLabz recently identified a new campaign delivering the latest version of ValleyRAT , which involves multiple stages. In this blog, we will provide a technical analysis of a campaign utilized to deliver ValleyRAT , diving into details and updates observed in the ValleyRAT sample.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.