ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt identifies potential ValleyRAT infections by correlating known IOCs against asset telemetry to detect the presence of this high-severity remote access trojan. Proactively hunting for these indicators allows the SOC to identify compromised endpoints early, preventing the adversary from establishing persistent remote access and exfiltrating sensitive data within the Azure Sentinel environment.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 9 IOC Types: sha256_hash, sha1_hash, md5_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`faa76da73875b164970434cd53cdf8d47e5b5d81335ce780fa1a0725c4dde843`	payload	2026-09-12	95%
sha1_hash	`3b367f889adce4f6ec1c131493c33a6a8e0c63ea`	payload	2026-09-12	95%
md5_hash	`ca69deb127174f928e7debff4dbcf4e9`	payload	2026-09-12	95%
sha1_hash	`d7999442a966d4e46c371e5d08b7e1a0c33ed910`	payload	2026-09-12	95%
md5_hash	`2254bd694ca0fd3d775ebb50e3568950`	payload	2026-09-12	95%
sha256_hash	`f231eb3b69bc197480b26779893f313d12267cb15f052475d0bcd097bd9feb4c`	payload	2026-09-12	95%
sha1_hash	`9bfa27e4601811837196239bbad0328117a86bbf`	payload	2026-09-12	95%
md5_hash	`e857eed1e71fa7360eae2d14126d9154`	payload	2026-09-12	95%
sha256_hash	`e3b85ca26c546d1dcf837d74c5f8b36f2c40c97c028226679177c7bbea771953`	payload	2026-09-12	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ValleyRAT
let malicious_hashes = dynamic(["faa76da73875b164970434cd53cdf8d47e5b5d81335ce780fa1a0725c4dde843", "3b367f889adce4f6ec1c131493c33a6a8e0c63ea", "ca69deb127174f928e7debff4dbcf4e9", "d7999442a966d4e46c371e5d08b7e1a0c33ed910", "2254bd694ca0fd3d775ebb50e3568950", "f231eb3b69bc197480b26779893f313d12267cb15f052475d0bcd097bd9feb4c", "9bfa27e4601811837196239bbad0328117a86bbf", "e857eed1e71fa7360eae2d14126d9154", "e3b85ca26c546d1dcf837d74c5f8b36f2c40c97c028226679177c7bbea771953"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — ValleyRAT

False Positive Guidance

Scenario: A DevOps engineer uses a CI/CD pipeline (e.g., Jenkins or GitHub Actions) to deploy a custom internal monitoring agent that shares a similar binary hash or file path structure with ValleyRAT IOCs.
- Filter/Exclusion: Exclude alerts where the parent process is a known build tool (e.g., java.exe, node.exe, docker.exe) or where the file path resides within standard build directories (e.g., C:\Jenkins\workspace\, C:\actions-runner\).
Scenario: An IT administrator runs a legacy backup utility or a specific vendor-provided cleanup script that creates temporary files with names matching ValleyRAT’s known artifact patterns (e.g., temp.dat or specific .tmp extensions) in the user’s %TEMP% directory.
- Filter/Exclusion: Exclude events where the file creation is initiated by a signed executable from a trusted vendor (e.g., Veeam.exe, Acronis.exe) or where the file path contains standard backup software directory structures (e.g., \Backup\, \Veeam\).
Scenario: A software developer compiles a C++ or C# application locally using Visual Studio or MSBuild, which generates intermediate object files or debug binaries that match the hash or naming conventions of ValleyRAT’s dropper components.
- Filter/Exclusion: Exclude alerts where the parent process is MSBuild.exe, devenv.exe, or csc.exe, and the file path is located within a project’s bin\ or obj\ directory.
Scenario: A security team performs a controlled red team exercise or a vulnerability scan using a tool like Nmap or Metasploit, which may drop small beaconing scripts or test binaries that mimic ValleyRAT’s IOCs for validation purposes.