ValleyRAT

Malware Family

277 indicators of compromise attributed to ValleyRAT across abuse.ch threat intelligence feeds.

Domains

29

IPs

72

URLs

12

Hashes

164

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

ttcxdljiue.cndomain1112.688608.xyzdomainzythdolm.cndomainjiesaida.cndomaindnmjbsbqsb.comdomaincccflknorgnsd.cndomainaeerglaeergl098.comdomainbackdoor.cyoudomain404xh.comdomain14cabp433878.vicp.fundomainso-axiom.comdomaingusikkwski.topdomainwwnbslklfdsrf.cndomainnishihaoren38.topdomainnishihaoren5.topdomaina.qqmusic1.comdomainc.360ctct.comdomainb.360ctct.comdomaincaishendaole.comdomainafdm.scloudflareb.comdomain103.73.161.238ip207.56.119.59ip14.128.53.229ip154.91.75.78ip18.162.74.188ip47.76.51.107ip134.122.155.142ip137.220.140.4ip154.12.19.70ip27.124.18.166ip103.231.14.104ip137.220.156.66ip103.75.46.34ip112.213.101.132ip134.122.128.66ip143.92.61.212ip103.43.11.40ip103.118.243.73ip192.253.228.193ip154.91.74.87iphttp://gxfsxs.cn:8880/getinstall64urlhttp://154.91.75.105/getinstall64urlhttp://qqdhq.cn/getinstall64urlhttp://osgyx.cn/getinstall64urlhttp://149.30.222.4/getinstall64urlhttp://103.80.135.33/getinstall64urlhttp://95.40.215.140/getinstall64urlhttp://18.163.217.102/getinstall64urlhttp://95.40.222.37/getinstall64urlhttp://43.198.235.91/getinstall64urlhttp://aidrmvo.cn/getinstall64urlhttp://nanuvvo.cn/getinstall64url96e5117b89a7f3b20cea680ebd4fe453715f4022a2cdca394b5a2c23aabe2361hash0fa2579031a74d6ac6477c036f2a53695ab92d907fd0220c48bba31dffa976dahash5baca90a1f5e596203c47a01f7a219bchash9ab135ec9d97c65caacdc2cd1ac166b7f491d8ad0635b3bd595a244ca6af9795hasheee7db42470f6c58dc1e696ee937e87bd72f0cabe8df566021a79880d288e370hasheeb2d44d0f86670ac2ee5e0b7aa44ec41b7be9962359f59ac21f736d7b0e7889hash26668a26d5eca6ecde87587b76b1e500cdf2f915hash79b63082f73ed3cab60901b9256a81b78de4192bhash