Skip to main content

ValleyRAT

Malware Family

4 293 indicators of compromise attributed to ValleyRAT across abuse.ch threat intelligence feeds.

Domains

161

IPs

538

URLs

54

Hashes

3 540

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (161)IPs (538)URLs (54)Hashes (3 540)

For continuous updates, the same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
teamszs.comdomain
rosklun.cndomain
taxcerf.topdomain
wwvsfkbjsdojfnor.cndomain
whatfuck000.intermediate.icudomain
mk65yui45876l.cyoudomain
sssjhvycytjnjoo.cndomain
www.cfqaz.cyoudomain
qyttqxsdf.cndomain
qwesxzxngtf.cndomain
qn666.usdomain
nishihaoren38.topdomain
txpfproxy.vipdomain
8801.1988945.xyzdomain
bei.tfuuuk.comdomain
dn.saohaoqi.comdomain
1080.aikkk.netdomain
slong.helpdomain
10809.aikkk.netdomain
404xh.comdomain
134.122.155.147ip
43.198.145.140ip
202.95.11.194ip
47.84.13.17ip
206.238.115.154ip
202.95.8.27ip
43.248.172.32ip
202.61.84.89ip
103.204.79.99ip
207.56.217.9ip
202.61.140.222ip
185.106.179.30ip
206.238.196.153ip
154.91.84.32ip
38.76.213.188ip
137.220.156.66ip
122.10.71.102ip
16.163.219.121ip
192.163.168.59ip
134.122.155.135ip
http://nanuvvo.cn/getinstall64url
https://withered-lake-8596.krzakanna172.workers.dev/url
https://divine-shape-b4fb.erinbraumbachlianebl.workers.dev/url
https://mt-link.qdhuzf.cc/cl/rlLXIXSwv8IKS9aWzYqx.GteIY.dfPLTRPY013hMjghjIqNPZYu0.3GRfdJuvkQ6tE_bREwYxiJYCce5tvEnoE3KBUTwvCDTiu2bDHWXZs0x1W9uo0iVh.1QNGRtX1FCHw7RAGf7rgebqPkGAHTMO9PNVObFPz6ZweWWMF.A8WcBWExrFhKajHLSIXt2Nztt0U74bljpjJsEHOma6bAX63E8oWmZHpihcBw2sQ~~--2IJbf9QXryunJZJU--8Oh.0r5JKH3jZkGT7hZ3yQ~~url
https://mt-link.jiosjcjp.club/cl/XyTkjX7q1dAL2BGNTd9WS4rxd2jM6dRs81I6p9oIabEzdaoU.hKBV4joWBgjmpuG1R7lQFSw.ycTLHGORYhj2SUP3sFXpIV6xdCcBG0RXRfRL7UHgFuOXTo2My_iS7qkQfe3qQ9HI3LZ8Yxj6VNOgU8mxReAxoA9FexD3dTAKBOPLMZS2YwrHmsCeDNS3nLZL3Bu53l9rtzb6rmz2xWLsLH_YpqfyMFUI0e7Ac9xKG.C0r8~--qdLygJPqKgnky9Es--_CzsqbW_5cv2HhL6j7Dr3w~~url
https://yfghrey-1433552157.cos.ap-hongkong.myqcloud.com/20260729074327.zipurl
https://lively-fog-72fd.piecestrengthen3327.workers.dev/url
http://fdsfsffdsf.shop/getinstall64url
http://18.163.217.102/getinstall64url
https://twilight-shadow-df0c.piecestrengthen3327.workers.dev/url
https://autumn-mountain-e855.erinbraumbachlianebl.workers.dev/url
https://kaiwyrey.eu.cc/d/bdc9637e70c2url
https://fragrant-shape-bd43.kucantoojd641.workers.dev/url
http://154.91.75.105/getinstall64url
http://45.91.226.120/getinstall64url
https://yu8y1w.oss-cn-beijing.aliyuncs.com/tadurl
https://mt-link.qdhuzf.cc/cl/a5UYfW_dao7L4uK02Y5e3T4RKwwLAq7x5FXAtyV8o3UJAUT_K5Ia0VIbWVrxBLXMNGzEK9WhhAhSQFoBqqCupKzzInKiHGMgGOcp1Yiigbo6JUPzwHm0YBF._JurP0LhKB4wt0m5H1gYc3aG149V2da397unkY11uVn30sF8DGJJMiZtmJS_UGZtI_JqupELrUzGNWj2gvSMSOq9_0IdaVJwLmuBiwllpHaogXqN4cKH--rCZGX49Rzqev4iXM--N6CY14rgI..iNc2Atg5k9g~~url
http://149.30.222.4/getinstall64url
https://frosty-tooth-517b.erinbraumbachlianebl.workers.dev/url
https://sweet-thunder-52f5.yenthi893197.workers.dev/url

Another file to check? Run a file hash reputation check.