MB-1d0b8f081975cc9dfb542c8da5d173c3a68a23531e83f07e86ccc706e56d76f3
high
📛 Threat Title
ValleyRAT: B33A668328313F6843B1B8094BFAFFE3.exe
Description
File type: exe. Size: 4331540 bytes. Tags: exe, RAT, ValleyRAT. Reporter: abuse_ch. First seen: 2026-08-04 21:45:28.
Indicators of Compromise (4)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_imphash
40ab50289f7ef5fae60801f88d4541fc
IOC database
- Type
- hash_imphash
- Value
40ab50289f7ef5fae60801f88d4541fc- First seen
- Last seen
- Attached to this threat
- Appears in
- 16 threats
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha256
1d0b8f081975cc9dfb542c8da5d173c3a68a23531e83f07e86ccc706e56d76f3
IOC database
- Type
- hash_sha256
- Value
1d0b8f081975cc9dfb542c8da5d173c3a68a23531e83f07e86ccc706e56d76f3- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- ValleyRAT
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
9681a8e07a3f673e5fad0cd3fd844ed67422ee0d
IOC database
- Type
- hash_sha1
- Value
9681a8e07a3f673e5fad0cd3fd844ed67422ee0d- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
b33a668328313f6843b1b8094bfaffe3
IOC database
- Type
- hash_md5
- Value
b33a668328313f6843b1b8094bfaffe3- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: exe. Size: 4331540 bytes. Tags: exe, RAT, ValleyRAT. Reporter: abuse_ch. First seen: 2026-08-04 21:45:28.
Remediations (10)
-
web:any.run
ValleyRAT is a malware used for attacking government organizations, important supply chains, and corporations.
-
web:cyberpress.org
On April 8, 2026, security researchers identified a new malware campaign from the Chinese-linked Silver Fox hacking group. The attackers are using a fake Chinese-language Telegram pack to silently infect Windows computers with a powerful backdoor known as ValleyRAT . This attack uses a complex six-step process, clever tricks to evade antivirus software, and a vulnerable computer driver to gain ...
-
web:cyberpress.org
ValleyRat malware - A newly identified malware campaign linked to the China-aligned group Silver Fox has been caught deploying the ValleyRat .
-
web:cybersecuritynews.com
ValleyRAT malware is spread via fake LINE installers, targeting Chinese users with stealthy loaders to steal credentials and evade detection.
-
web:research.checkpoint.com
ValleyRAT is strongly associated with Chinese-speaking threat actors, so we expanded our search with Chinese keywords and phrases that seemed relevant to the malware. This approach was successful: we found not only the ValleyRAT builder but also its development structure, including Visual Studio solutions and project files.
-
web:www.cybereason.com
In this Threat Analysis Report, Cybereason explores the fake installer, ValleyRAT
-
web:www.levelblue.com
LevelBlue has identified two distinct attack vectors associated with ValleyRAT : campaigns leveraging fake installers and campaigns initiated through malicious emails.
-
web:www.pcrisk.com
ValleyRAT is a recently discovered malware that has drawn attention in the cybersecurity community. RATs, or Remote Access Trojans, are malicious software programs that enable threat actors to gain remote access and control over a victim's computer.
-
web:www.picussecurity.com
ValleyRAT is a multi-stage Windows remote-access trojan (RAT) first observed in early 2023 and now linked to focused campaigns targeting Chinese-language users and organizations. Operators deliver staged components (downloader → loader → injector → RAT) via phishing or trojanized installers, and rely on in-memory decryption and living-off-the-land execution (notably MSBuild.exe) to ...
-
web:www.zscaler.com
Zscaler ThreatLabz recently identified a new campaign delivering the latest version of ValleyRAT , which involves multiple stages. In this blog, we will provide a technical analysis of a campaign utilized to deliver ValleyRAT , diving into details and updates observed in the ValleyRAT sample.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.