s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-2013313 high

📛 Threat Title

ValleyRAT: SHA1 hash of a malware sample (payload) db9cc2c27bc50cbc2bd03e9a1145e645b941b45d

Category: ValleyRAT Published: Source updated: First seen: Last updated: Source: Threatfox IOCs/Threats

Description

Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: ValleyRAT (aliases: Winos). Confidence: 95. First seen: 2026-11-03 16:42:40 UTC. Reporter: Grim.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha1 db9cc2c27bc50cbc2bd03e9a1145e645b941b45d VT 29 / 75

IOC database

Type
hash_sha1
Value
db9cc2c27bc50cbc2bd03e9a1145e645b941b45d
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
SHA1 hash of a malware sample (payload) attributed to ValleyRAT

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 29 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Win.Generic.C5925952
Alibaba malicious RiskWare:Win32/UnwantedX.4aed8724
alibabacloud malicious Trojan:Win/Agent.ALNG
Antiy-AVL malicious Trojan/Win32.Agent
Bkav malicious W32.Malware.758DCE41
Cylance malicious Unsafe
DeepInstinct malicious MALICIOUS
DrWeb malicious Trojan.Siggen36.56041
Elastic malicious malicious (high confidence)
ESET-NOD32 malicious Win32/Agent.AIVK trojan
GData malicious Win32.Trojan.Agent.3H4N53
huorong malicious Backdoor/Lotok.vq
Ikarus malicious Trojan.Win32.Agent
K7AntiVirus malicious Trojan ( 006e68ad1 )
K7GW malicious Trojan ( 006e68ad1 )
Kaspersky malicious Trojan.Win32.Agent.xyefwz
Lionic malicious Trojan.Win32.UnwantedX.4!c
Malwarebytes malicious Trojan.MalPack
McAfeeD malicious Trojan:Win/ValleyRat.RT
Microsoft malicious Trojan:Win32/Malgent
Panda malicious Trj/PhxBzA.A
Rising malicious Trojan.MalCert@XH.0FA3 (CERT:P7JHvHPWmMLQXS8XmNmKNQ)
SentinelOne malicious Static AI - Suspicious PE
Sophos malicious Mal/Generic-S
Symantec malicious ML.Attribute.HighConfidence
Tencent malicious Win32.Trojan.FalseSign.Dtgl
Varist malicious W32/ABTrojan.VSBV-4743
VBA32 malicious Backdoor.Pallas
VirIT malicious PUP.Win32.Agent.IXV

Details From VirusTotal

Basic Properties
MD56f3a5bc8b5a1f80f4c3f490e26e107e6
SHA-1db9cc2c27bc50cbc2bd03e9a1145e645b941b45d
SHA-256217503ba2e91713bcce9f9a221f69f192655b53d0d0596eb6467d71580f2b01c
VHash02703e7e6d1bz4!z
SSDEEP393216:PZJ0gTxVq+zQuD1p1EYbnqvjNwmL8dtBekw2z0rOU7H9qa9inl57VOo8LE1teelY:b0ek+5bnqvJvutxw2oOU7D9eLH1teeXq
TLSHT1C83733F26275CC76DA66E6FCB0DD9491ADE11421ABBFD9032839C185129833139CEDCE
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386, for MS Windows, PECompact2 compressed
File size22.9 MB
History
Creation date2026-10-27 01:26 UTC
First seen on VirusTotal2026-11-02 23:12 UTC
Last submission2026-11-03 00:07 UTC
Last analysis2026-11-04 00:38 UTC
Last modified on VirusTotal2026-11-04 00:50 UTC
Known Names
  • dm_loader.exe
  • 217503ba2e91713bcce9f9a221f69f192655b53d0d0596eb6467d71580f2b01c.exe
  • fjdgpr28g.exe
  • 207.56.28.198 (2).exe

References (2)

  • Malpedia profile Threatfox IOCs/Threats
  • ThreatFox IOC page Threatfox IOCs/Threats

    Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: ValleyRAT (aliases: Winos). Confidence: 95. First seen: 2026-11-03 16:42:40 UTC. Reporter: Grim.

Remediations (10)

  • MalwareBazaar | ValleyRAT
    web:bazaar.abuse.ch

    A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as ValleyRAT .

  • MalwareBazaar | ValleyRAT
    web:bazaar.abuse.ch

    Malware samples associated with tag ValleyRAT MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with ValleyRAT . Database Entry

  • Arkana/docs/examples/example-report-valleyrat.md at main - GitHub
    web:github.com

    This report documents the complete multi-stage unpacking and C2 extraction of a ValleyRAT sample — a Chinese-origin remote access trojan associated with the Silver Fox APT group. The analysis required reversing 5 layers of encryption and encoding to reach the final implant and extract its C2 ...

  • ValleyRAT-Malware-Analysis/Reports/ValleyRat-EN.md at main ... - GitHub
    web:github.com

    ValleyRAT is a Remote Access Trojan (RAT) family targeting Windows operating systems that first appeared in publicly available reports in 2023. The malware is capable of remotely executing commands on infected systems, collecting system and user information, performing file operations, and delivering additional malicious components to the system.

  • Malware Hash Lookup — Check MD5, SHA-1 & SHA-256
    web:imalware.com

    It compares a file's fingerprint (its MD5, SHA-1 or SHA-256 hash ) with a list of fingerprints of known malware . If the hash matches, the file is identical to a known malicious sample .

  • Hash Checker - File & Malware Hash Lookup | InventiveHQ
    web:inventivehq.com

    Check any file hash in seconds. Paste an MD5, SHA-1 or SHA-256 hash , or drop a file to hash it locally, then check it against live malware feeds.

  • ValleyRAT (Malware Family) - Fraunhofer
    web:malpedia.caad.fkie.fraunhofer.de

    Details for the ValleyRAT malware family including references, samples and yara signatures.

  • ThreatFox | 7c0d91f3d3b03ea076368c432e69a98f3484e0d4
    web:threatfox.abuse.ch

    ValleyRAT IOC: 7c0d91f3d3b03ea076368c432e69a98f3484e0d4 ( sha1_hash ) You are viewing the ThreatFox database entry for sha1_hash 7c0d91f3d3b03ea076368c432e69a98f3484e0d4.

  • Dissecting ValleyRAT: From Loader to RAT Execution in Targeted Campaigns
    web:www.picussecurity.com

    ValleyRAT is a multi-stage Windows remote-access trojan (RAT) first observed in early 2023 and now linked to focused campaigns targeting Chinese-language users and organizations. Operators deliver staged components (downloader → loader → injector → RAT) via phishing or trojanized installers, and rely on in-memory decryption and living-off-the-land execution (notably MSBuild.exe) to ...

  • Check Any File Against Our Malware Hash Database | Team Cymru
    web:www.team-cymru.com

    Check MD5, SHA-1 , or SHA-256 hashes against 30+ antivirus databases. Team Cymru's Malware Hash Registry speeds triage via HTTPS, DNS, or WHOIS.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.