ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt targets known indicators of compromise associated with ValleyRAT, a remote access trojan frequently used for initial access and lateral movement. Proactively hunting these IOCs in Azure Sentinel allows the SOC to identify compromised endpoints before the adversary establishes persistent control or exfiltrates sensitive data.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 9 IOC Types: md5_hash, sha256_hash, sha1_hash

Type	Value	Threat Type	First Seen	Confidence
sha1_hash	`53adfabab985eca17ff3baea02873934c728d574`	payload	2026-09-11	95%
md5_hash	`7c4224b91735fb594820ee3722d02551`	payload	2026-09-11	95%
md5_hash	`8264bcaf76a6ff84e9d20bfd04f77ecf`	payload	2026-09-11	95%
sha256_hash	`b1507fec0d085fb2c5aaaae94ee180f30cf4e628b6e30f7a4f6c20f509ffb1c5`	payload	2026-09-11	95%
md5_hash	`0a1e35182d1fc715d743b5ae3a5bd1c0`	payload	2026-09-11	95%
sha256_hash	`9aba970c5a0c5aa17d30720718a12c4bad31d826ef0e603c06c454d7b585fcde`	payload	2026-09-11	95%
sha1_hash	`764040032ceea936dbdfac085abb04fa1950435a`	payload	2026-09-11	95%
sha256_hash	`3ac2984fed333b82ee4e58332df41cfb31f6f6f56b3e00285febef138f2bd864`	payload	2026-09-11	95%
sha1_hash	`b604a52a4bb4911a0b947fa0b052fe1fa52323d7`	payload	2026-09-11	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ValleyRAT
let malicious_hashes = dynamic(["53adfabab985eca17ff3baea02873934c728d574", "7c4224b91735fb594820ee3722d02551", "8264bcaf76a6ff84e9d20bfd04f77ecf", "b1507fec0d085fb2c5aaaae94ee180f30cf4e628b6e30f7a4f6c20f509ffb1c5", "0a1e35182d1fc715d743b5ae3a5bd1c0", "9aba970c5a0c5aa17d30720718a12c4bad31d826ef0e603c06c454d7b585fcde", "764040032ceea936dbdfac085abb04fa1950435a", "3ac2984fed333b82ee4e58332df41cfb31f6f6f56b3e00285febef138f2bd864", "b604a52a4bb4911a0b947fa0b052fe1fa52323d7"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — ValleyRAT

False Positive Guidance

Legacy Backup Agent Configuration: ValleyRAT IOCs often include specific file paths or registry keys associated with its payload. In environments using legacy backup solutions (e.g., Veeam, Commvault, or Acronis), the backup agent service may write configuration files or temporary artifacts to locations that match the hunt package’s file hash or path criteria.
- Filter/Exclusion: Exclude file paths under C:\Program Files\BackupAgent\ or specific service executables like vssadmin.exe and commvault\agents\ from the file-based IOC checks.
Third-Party Remote Support Tools: ValleyRAT frequently uses standard Windows remote administration utilities or bundles its own remote shell. Legitimate IT support teams often deploy tools like TeamViewer, AnyDesk, or Citrix GoToAssist, which may create user-mode processes or registry entries that overlap with ValleyRAT’s persistence mechanisms (e.g., HKCU\Software\Microsoft\Windows\CurrentVersion\Run keys pointing to support tool executables).
- Filter/Exclusion: Exclude known support tool executables (e.g., TeamViewer.exe, AnyDesk.exe, GoToAssist.exe) and their associated registry run keys from the persistence IOC checks.
Software Update and Patch Management Agents: Patch management tools (e.g., SCCM, WSUS, or Ansible) often execute PowerShell scripts or batch files to apply updates, which may temporarily create files in C:\Windows\Temp or C:\Users\Public with names or hashes that coincidentally match ValleyRAT’s dropped files. Additionally, these agents may modify system time or use specific network ports that align with ValleyRAT’s C2 communication patterns.
- Filter/Exclusion: Exclude processes spawned by Dism.exe, wusa.exe, or ccmexec.exe