MB-8de2d51797f113896007d6ed8c634d99f5cee4c34c2bf55b1e4c19432afcbab3
high
📛 Threat Title
ValleyRAT: C5940ABAE3FB2C368F0841417C9B0454.exe
Description
File type: exe. Size: 8073531 bytes. Tags: exe, RAT, ValleyRAT. Reporter: abuse_ch. First seen: 2026-08-04 21:45:32.
Indicators of Compromise (4)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
8de2d51797f113896007d6ed8c634d99f5cee4c34c2bf55b1e4c19432afcbab3
IOC database
- Type
- hash_sha256
- Value
8de2d51797f113896007d6ed8c634d99f5cee4c34c2bf55b1e4c19432afcbab3- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- ValleyRAT
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
4a7d250aa077b7e3a2923cf7451058ae07a69b77
IOC database
- Type
- hash_sha1
- Value
4a7d250aa077b7e3a2923cf7451058ae07a69b77- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
c5940abae3fb2c368f0841417c9b0454
IOC database
- Type
- hash_md5
- Value
c5940abae3fb2c368f0841417c9b0454- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_imphash
d61098bb34ea41207b7b575f9f5f033b
IOC database
- Type
- hash_imphash
- Value
d61098bb34ea41207b7b575f9f5f033b- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: exe. Size: 8073531 bytes. Tags: exe, RAT, ValleyRAT. Reporter: abuse_ch. First seen: 2026-08-04 21:45:32.
Remediations (10)
-
web:any.run
ValleyRAT is a malware used for attacking government organizations, important supply chains, and corporations.
-
web:cyberpress.org
ValleyRat malware - A newly identified malware campaign linked to the China-aligned group Silver Fox has been caught deploying the ValleyRat .
-
web:cybersecuritynews.com
ValleyRAT has emerged as a sophisticated multi-stage remote access trojan targeting Windows systems, with particular focus on Chinese-language users and organizations. First observed in early 2023, this malware employs a carefully orchestrated infection chain that progresses through multiple components—downloader, loader, injector, and final payload—making detection and removal ...
-
web:cybersecuritynews.com
ValleyRAT malware is spread via fake LINE installers, targeting Chinese users with stealthy loaders to steal credentials and evade detection.
-
web:gbhackers.com
A recent surge in ValleyRAT activity that combines RC4-encrypted payloads, Donut-generated shellcode, and in-memory execution via suspended rundll32 processes to evade detection.
-
web:research.checkpoint.com
ValleyRAT is strongly associated with Chinese-speaking threat actors, so we expanded our search with Chinese keywords and phrases that seemed relevant to the malware. This approach was successful: we found not only the ValleyRAT builder but also its development structure, including Visual Studio solutions and project files.
-
web:www.cybereason.com
In this Threat Analysis Report, Cybereason explores the fake installer, ValleyRAT
-
web:www.pcrisk.com
ValleyRAT is a recently discovered malware that has drawn attention in the cybersecurity community. RATs, or Remote Access Trojans, are malicious software programs that enable threat actors to gain remote access and control over a victim's computer.
-
web:www.picussecurity.com
ValleyRAT is a multi-stage Windows remote-access trojan (RAT) first observed in early 2023 and now linked to focused campaigns targeting Chinese-language users and organizations. Operators deliver staged components (downloader → loader → injector → RAT) via phishing or trojanized installers, and rely on in-memory decryption and living-off-the-land execution (notably MSBuild.exe) to ...
-
web:www.zscaler.com
Zscaler ThreatLabz recently identified a new campaign delivering the latest version of ValleyRAT , which involves multiple stages. In this blog, we will provide a technical analysis of a campaign utilized to deliver ValleyRAT , diving into details and updates observed in the ValleyRAT sample.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.