ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt targets adversary behavior involving the execution of known ValleyRAT indicators across endpoints to detect active reconnaissance or data exfiltration campaigns. The SOC team should proactively search for these specific IOCs in Azure Sentinel to identify early-stage infections before they escalate into broader lateral movement incidents within the cloud environment.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 13 IOC Types: md5_hash, sha1_hash, sha256_hash, ip:port, url

Type	Value	Threat Type	First Seen	Confidence
url	hxxp://149[.]30[.]222[.]4/getinstall64	botnet_cc	2026-06-30	100%
ip:port	47[.]243[.]127[.]117:889	botnet_cc	2026-06-29	75%
ip:port	47[.]243[.]127[.]117:887	botnet_cc	2026-06-29	100%
md5_hash	a8480f1bd4fc75a68930f3c60df63955	payload	2026-06-29	95%
md5_hash	63844cd3d2578789f0e5ca58cfddf9d4	payload	2026-06-29	95%
sha256_hash	ffe98374173d7c2084a1a6953b308c13a8b9493294af831c23542b0d88654036	payload	2026-06-29	95%
sha1_hash	ce609cfde7d81bc7311a83e0f008a2f756912ea9	payload	2026-06-29	95%
sha256_hash	d6ca3c85df784f0b7751f67bc0b23f44f173b7be7f6344d02f26c8e28e0abad8	payload	2026-06-29	95%
sha1_hash	ab84b6726d46e9cdc1349d2c8cfb9777dac57101	payload	2026-06-29	95%
md5_hash	91ca6805aabe73cabd12644fccf91ec5	payload	2026-06-29	95%
sha256_hash	ab168b5a63520e7cabe5d2d3917e1b9b1b388db0b3f27354bc7cd075e63cc7dd	payload	2026-06-29	95%
sha1_hash	a29d766799b35f8c9a4fbc3950295aedc17c7e9a	payload	2026-06-29	95%
ip:port	134[.]122[.]128[.]106:443	botnet_cc	2026-06-29	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["47.243.127.117", "134.122.128.106"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["47.243.127.117", "134.122.128.106"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - ValleyRAT
let malicious_urls = dynamic(["http://149.30.222.4/getinstall64"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ValleyRAT
let malicious_hashes = dynamic(["a8480f1bd4fc75a68930f3c60df63955", "63844cd3d2578789f0e5ca58cfddf9d4", "ffe98374173d7c2084a1a6953b308c13a8b9493294af831c23542b0d88654036", "ce609cfde7d81bc7311a83e0f008a2f756912ea9", "d6ca3c85df784f0b7751f67bc0b23f44f173b7be7f6344d02f26c8e28e0abad8", "ab84b6726d46e9cdc1349d2c8cfb9777dac57101", "91ca6805aabe73cabd12644fccf91ec5", "ab168b5a63520e7cabe5d2d3917e1b9b1b388db0b3f27354bc7cd075e63cc7dd", "a29d766799b35f8c9a4fbc3950295aedc17c7e9a"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
CommonSecurityLog	Ensure this data connector is enabled
DeviceFileEvents	Ensure this data connector is enabled
DeviceNetworkEvents	Ensure this data connector is enabled
UrlClickEvents	Ensure this data connector is enabled

References

• ThreatFox — ValleyRAT

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: ValleyRAT IOCs detection rule in an enterprise environment, along with recommended filters or exclusions:

• Endpoint Protection Agent Updates and Definition Scans

  • Scenario: Enterprise Endpoint Detection and Response (EDR) agents like CrowdStrike Falcon, SentinelOne, or Microsoft Defender for Endpoint frequently download new threat intelligence feeds. These updates often include hash signatures or network artifacts that overlap with the ValleyRAT IOCs, particularly if the EDR vendor has ingested the same ThreatFox data.
  • Filter/Exclusion: Exclude processes originating from the specific EDR service executables (e.g., C:\Program Files\CrowdStrike\fs.exe, C:\Windows\System32\defenderappservice.exe) and network connections to known EDR update endpoints (e.g., *.crowdstrike.com, *.microsoft.com).

• Scheduled Software Deployment via SCCM or Intune

  • Scenario: During nightly maintenance windows, the IT team uses Microsoft Endpoint Configuration Manager (SCCM) or Intune to push application updates. If a deployed application installer contains a shared library or component that matches one of the 13 ValleyRAT file hashes, the deployment agent (e.g., ccmexec.exe or intunagent.exe) will trigger the rule while installing legitimate software across the fleet.
  • Filter/Exclusion: Create an exclusion for the parent process ccmexec.exe and intunagent.exe. Additionally, filter out file creation events where the “User” attribute is a service account (e.g., DOMAIN\SCCM-Deploy-Svc) rather than interactive user accounts.

• Third-Party Backup and Archiving Solutions

  • Scenario: Enterprise backup tools such as **