ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt targets the presence of known ValleyRAT indicators of compromise, which are frequently used by adversaries to establish persistent remote access and exfiltrate sensitive data. Proactively hunting for these IOCs in Azure Sentinel allows the SOC team to identify compromised assets early, potentially before the malware can execute its full payload or establish a stable command-and-control channel.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 15 IOC Types: sha256_hash, md5_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
md5_hash	`3c143cde7d767aba3024349739d9d708`	payload	2026-09-04	95%
sha1_hash	`ae42cc9a3b33728a7e3cbf98a251ec2782b4f4b5`	payload	2026-09-04	95%
md5_hash	`dc4054f1ff61a001d3d872ae280b3208`	payload	2026-09-04	95%
sha256_hash	`1055656b4243a6f96db475f0fd2f8506a944f65eaea22789c409220b2b82040b`	payload	2026-09-04	95%
sha1_hash	`0dd128e087b0740d6cb86c502815d9b6697fc80b`	payload	2026-09-04	95%
sha1_hash	`6572fd0e50094c7f2ff4aa7267893ec09853b3e4`	payload	2026-09-04	95%
md5_hash	`ee532fd47952c2b5ad8cb3cd3a92757d`	payload	2026-09-04	95%
sha256_hash	`50f8064aa9924f674b5b7d24d1562f35f11007cc8ef57a7a3ce07e0f713efba1`	payload	2026-09-04	95%
sha1_hash	`e584cc74edc4bee1b7808ec6c287a24376a8e05d`	payload	2026-09-04	95%
md5_hash	`6ac22b0b445d781a3b104ed39d3f7693`	payload	2026-09-04	95%
sha256_hash	`13b5ce5838356cffbb328312b4509eef0662d2d3434b683f177bb0aaf8281b9c`	payload	2026-09-04	95%
sha1_hash	`a7c737cd5dee4c165d2e0d5a44b256340f89db58`	payload	2026-09-04	95%
md5_hash	`f2d73d70f95b645bbdfcc00f306ce16d`	payload	2026-09-04	95%
sha256_hash	`f650d42dc1d33f8e776b9eadbc7f8789868b20d97b48d1d2338532ba81d36337`	payload	2026-09-04	95%
sha256_hash	`966b1fea9cdc54843a728b1a870bfb7d2f8109085b6114455d6e2635ab1ad40f`	payload	2026-09-04	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ValleyRAT
let malicious_hashes = dynamic(["3c143cde7d767aba3024349739d9d708", "ae42cc9a3b33728a7e3cbf98a251ec2782b4f4b5", "dc4054f1ff61a001d3d872ae280b3208", "1055656b4243a6f96db475f0fd2f8506a944f65eaea22789c409220b2b82040b", "0dd128e087b0740d6cb86c502815d9b6697fc80b", "6572fd0e50094c7f2ff4aa7267893ec09853b3e4", "ee532fd47952c2b5ad8cb3cd3a92757d", "50f8064aa9924f674b5b7d24d1562f35f11007cc8ef57a7a3ce07e0f713efba1", "e584cc74edc4bee1b7808ec6c287a24376a8e05d", "6ac22b0b445d781a3b104ed39d3f7693", "13b5ce5838356cffbb328312b4509eef0662d2d3434b683f177bb0aaf8281b9c", "a7c737cd5dee4c165d2e0d5a44b256340f89db58", "f2d73d70f95b645bbdfcc00f306ce16d", "f650d42dc1d33f8e776b9eadbc7f8789868b20d97b48d1d2338532ba81d36337", "966b1fea9cdc54843a728b1a870bfb7d2f8109085b6114455d6e2635ab1ad40f"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — ValleyRAT

False Positive Guidance

Scenario: A DevOps team deploys a custom PowerShell script to automate the cleanup of temporary files and logs on application servers, which includes a regex pattern or string match that coincidentally matches one of the 15 ValleyRAT IOCs (e.g., a specific hash or registry key name used for internal tagging).
- Filter/Exclusion: Exclude alerts where the process path is C:\Program Files\InternalTools\cleanup.ps1 or where the parent process is powershell.exe initiated by a known service account (e.g., svc-devops) and the execution context is a scheduled task named Daily-Cleanup.
Scenario: An IT administrator runs a standard Windows Update or patch management tool (such as SCCM or WSUS client) that temporarily writes a configuration file or creates a registry key matching a ValleyRAT IOC (e.g., a specific GUID or file name) during the update process.
- Filter/Exclusion: Exclude alerts where the parent process is wuauclt.exe or svchost.exe (with the netsvcs or kdump service group) and the event timestamp aligns with the organization’s standard patch window (e.g., Sundays between 02:00–04:00).
Scenario: A security engineer performs a manual threat hunt or validation test by deploying a known ValleyRAT sample or a YARA rule scanner (e.g., using yara or clamscan) on a non-production test VM, which triggers the IOC detection.
- Filter/Exclusion: Exclude alerts where the source IP address is within the designated test/lab subnet (e.g., 10.20.0.0/24) or where the hostname matches the pattern *test* or *lab*, and the user context is