MB-3e6b5327d9d19cdcd8adf389b991cba090c49bd9f11d4909da89e19420c16b42
high
📛 Threat Title
ValleyRAT: 83A191C82A700BD83128F7AD8576A1CD.dll
Description
File type: dll. Size: 346112 bytes. Tags: dll, RAT, ValleyRAT. Reporter: abuse_ch. First seen: 2026-08-04 21:45:21.
Indicators of Compromise (4)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_imphash
3d78bbe1faa6a6dae6c4cb9020627809
IOC database
- Type
- hash_imphash
- Value
3d78bbe1faa6a6dae6c4cb9020627809- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha256
3e6b5327d9d19cdcd8adf389b991cba090c49bd9f11d4909da89e19420c16b42
IOC database
- Type
- hash_sha256
- Value
3e6b5327d9d19cdcd8adf389b991cba090c49bd9f11d4909da89e19420c16b42- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- ValleyRAT
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
5cdbcbbd73e6c239fd73ee8597e0e57d7c4182f5
IOC database
- Type
- hash_sha1
- Value
5cdbcbbd73e6c239fd73ee8597e0e57d7c4182f5- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
83a191c82a700bd83128f7ad8576a1cd
IOC database
- Type
- hash_md5
- Value
83a191c82a700bd83128f7ad8576a1cd- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: dll. Size: 346112 bytes. Tags: dll, RAT, ValleyRAT. Reporter: abuse_ch. First seen: 2026-08-04 21:45:21.
Remediations (10)
-
web:any.run
ValleyRAT is a malware used for attacking government organizations, important supply chains, and corporations.
-
web:cyberpress.org
Cybersecurity researchers are tracking a highly aggressive, ongoing campaign by the SilverFox threat group, which is currently deploying an advanced variant of the ValleyRAT malware. While traditional Remote Access Trojans typically rely on a brief two- or three-stage infection process, this new operation is notable for executing an incredibly complex eight-stage kill chain. The attack ...
-
web:cyberpress.org
The ValleyRat campaign shows that actors' growing proficiency in integrating BYOVD, DLL sideloading, and anti‑forensic tactics reminds defenders that trusted software installers remain one of today's most effective social‑engineering lures.
-
web:cybersecuritynews.com
ValleyRAT malware is spread via fake LINE installers, targeting Chinese users with stealthy loaders to steal credentials and evade detection.
-
web:intel.mjolnirsecurity.com
ValleyRAT (also known as ValleyRAT , Silver Fox) is a C++/Rust-based remote access trojan active since 2023. Chinese-origin RAT targeting Chinese speakers. Key capabilities include: shellcode injection, multi-stage loader, targets Chinese-speaking finance/accounting users.
-
web:research.checkpoint.com
The ValleyRAT rootkit module is embedded inside one of the "main" plugins, originally named 驱动插件 (EN: Driver Plugin.dll). This plugin is compiled in both 32-bit and 64-bit variants and acts as the user-mode client and installer for the rootkit.
-
web:www.cybereason.com
In this Threat Analysis Report, Cybereason explores the fake installer, ValleyRAT
-
web:www.pcrisk.com
ValleyRAT can drop and execute Dynamic Link Library (DLL) files and other types of files on the compromised system. This capability lets the malware execute code or applications of its choice, which could include additional malicious payloads (e.g., ransomware or cryptocurrency miners) or tools.
-
web:www.picussecurity.com
ValleyRAT is a multi-stage Windows remote-access trojan (RAT) first observed in early 2023 and now linked to focused campaigns targeting Chinese-language users and organizations. Operators deliver staged components (downloader → loader → injector → RAT) via phishing or trojanized installers, and rely on in-memory decryption and living-off-the-land execution (notably MSBuild.exe) to ...
-
web:www.zscaler.com
Zscaler ThreatLabz recently identified a new campaign delivering the latest version of ValleyRAT , which involves multiple stages. In this blog, we will provide a technical analysis of a campaign utilized to deliver ValleyRAT , diving into details and updates observed in the ValleyRAT sample.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.