Malicious
PE Executable
MD5: e3d97a4758022978591358f1ba279c35
Size: 220.16 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
Portable Executable file
Size
220.16 KB · 220,160 B
First seen
2026-06-30 05:31 · 3 months ago
Last seen
2026-06-30 05:31 · 3 months ago
Last analysis
2026-09-03 21:34 · one month ago
Hashes
MD5
e3d97a4758022978591358f1ba279c35
Sha1
46b27a95bc6b2f296d28423461eda45a7f0f873d
Sha256
830408b2761d04f51e1e6b68e82256faffff47fbdc96286146a091c530da3ad4
Sha384
3d079156d35e2130b0466e03ec56b9fae38a458e39d6e520849bd2e3b27f664efe576a1f75477a0d616e073287ace321
Sha512
13e917ebcf9fd7ae1d381b8295ae61d62cda5a2e0e6862c890d9d00e15f37ef9f85f501dcdad07968d94029f968bc1f995390e818b56f0ecc29b24dddc336174
SSDeep
6144:R3WOArZU5HEl9YKmfeHvkZWNSbgN4YYYYE:dfA1U5HEl8eHvkZWNSHYYYY
TLSH
69247C217680C13BC19B1A3196BF9F7628BCAA35176581CBB7904EB91E707D1FE3470A
Detection
PeID
MS Visual C++ v7.0 DLLMicrosoft Visual C++ 6.0 DLL (Debug)Microsoft Visual C++ 7.0 - 8.0Microsoft Visual C++ v6.0 DLLPrivate EXE Protector V2.30-V2.3X -> SetiSoft TeamVisual C++ 2003 DLL -> MicrosoftVisual C++ 2005 DLL -> Microsoft
1 malicious · 2 files
EXEe3d97a4758022978591358f1ba279c35ValleyRat
Structure
BINResources
STICH
beta
No STICH Path has been generated for this analysis yet.
1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.
bin
1| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | s���N�huhuhuhuhuhuhuhuhuhuhu |
| UserAgent | t�a�s�huhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | 4���x�huhuhuhuhuhuhuhuhuhuhu |
| UserAgent | s�h�a�huhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential