ValleyRAT

Malware Family

253 indicators of compromise attributed to ValleyRAT across abuse.ch threat intelligence feeds.

Domains

29

IPs

67

URLs

9

Hashes

148

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

ttcxdljiue.cndomainzzlkkghnmh.cndomain1112.688608.xyzdomaingxfsxs.cndomainzythdolm.cndomainjiesaida.cndomaindowncry.s3.ap-east-1.amazonaws.comdomaindnmjbsbqsb.comdomaincccflknorgnsd.cndomainaeerglaeergl098.comdomain2844.xzz.camdomainbackdoor.cyoudomain14cabp433878.vicp.fundomainwwnbslklfdsrf.cndomainteams-securecall.comdomainnishihaoren38.topdomainnishihaoren5.topdomaincehoirfg.workdomainafdm.scloudflareb.comdomainqqdhq.cndomain103.238.225.156ip27.124.45.97ip8.217.144.219ip103.73.161.238ip118.107.9.185ip154.91.75.78ip38.46.13.178ip38.46.13.179ip47.86.32.238ip50.114.184.68ip47.76.51.107ip134.122.155.142ip137.220.140.4ip134.122.128.106ip154.82.93.76ip104.143.33.78ip43.248.172.115ip43.157.212.233ip202.95.8.27ip103.12.149.93iphttp://gxfsxs.cn:8880/getinstall64urlhttp://154.91.75.105/getinstall64urlhttp://qqdhq.cn/getinstall64urlhttp://osgyx.cn/getinstall64urlhttp://149.30.222.4/getinstall64urlhttp://103.80.135.33/getinstall64urlhttp://95.40.215.140/getinstall64urlhttp://18.163.217.102/getinstall64urlhttp://95.40.222.37/getinstall64urla58321399f8aa6098a602e0336e4e3e4910412fae67f35baacceb90cf93625bchashdeca2a324fd48fbb33a39ee4845e5b05f694ff88hash7dec659ecec8d9ff214b5af9f0e54d38hashc211776370bab8368f126d414eb2ea3d55ae7da8hash5a870518ce64edd9ba7185b1e3686fdcd7a4a13df7ca4835e9a68ae0f41caf7chashb8b16633d9cc1eda12aa9415d2fa2e91f39ffe8b7a94e38812e5c49ac88fe9cahashc2129f59f43570484456038599bcf74bhashd11e793159f0da3c88a9ecebb8e5df88919843a1eeaaf71117377db58224a1aehash5e1bc0c513824834b48ccd088bf1b9e112a0c650f930fe042a582f6aab1ab421hash0ea50e2b1161e55bbed355b12283f268da1021ffhash9ab135ec9d97c65caacdc2cd1ac166b7f491d8ad0635b3bd595a244ca6af9795hash