This hunt targets the presence of ValleyRAT, a remote access trojan known for enabling persistent backdoor access and data exfiltration, by correlating its specific indicators of compromise against your Azure Sentinel telemetry. Proactively hunting for these IOCs is critical to identify compromised endpoints before the adversary leverages the RAT to establish command-and-control channels or escalate privileges within the environment.
Malware Family: ValleyRAT Total IOCs: 18 IOC Types: md5_hash, ip:port, sha256_hash, sha1_hash
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 134[.]122[.]187[.]74:80 | botnet_cc | 2026-09-05 | 75% |
| ip:port | 134[.]122[.]187[.]74:8888 | botnet_cc | 2026-09-05 | 75% |
| ip:port | 134[.]122[.]187[.]74:6666 | botnet_cc | 2026-09-05 | 100% |
| md5_hash | 3c143cde7d767aba3024349739d9d708 | payload | 2026-09-04 | 95% |
| sha1_hash | ae42cc9a3b33728a7e3cbf98a251ec2782b4f4b5 | payload | 2026-09-04 | 95% |
| md5_hash | dc4054f1ff61a001d3d872ae280b3208 | payload | 2026-09-04 | 95% |
| sha256_hash | 1055656b4243a6f96db475f0fd2f8506a944f65eaea22789c409220b2b82040b | payload | 2026-09-04 | 95% |
| sha1_hash | 0dd128e087b0740d6cb86c502815d9b6697fc80b | payload | 2026-09-04 | 95% |
| sha1_hash | 6572fd0e50094c7f2ff4aa7267893ec09853b3e4 | payload | 2026-09-04 | 95% |
| md5_hash | ee532fd47952c2b5ad8cb3cd3a92757d | payload | 2026-09-04 | 95% |
| sha256_hash | 50f8064aa9924f674b5b7d24d1562f35f11007cc8ef57a7a3ce07e0f713efba1 | payload | 2026-09-04 | 95% |
| sha1_hash | e584cc74edc4bee1b7808ec6c287a24376a8e05d | payload | 2026-09-04 | 95% |
| md5_hash | 6ac22b0b445d781a3b104ed39d3f7693 | payload | 2026-09-04 | 95% |
| sha256_hash | 13b5ce5838356cffbb328312b4509eef0662d2d3434b683f177bb0aaf8281b9c | payload | 2026-09-04 | 95% |
| sha1_hash | a7c737cd5dee4c165d2e0d5a44b256340f89db58 | payload | 2026-09-04 | 95% |
| md5_hash | f2d73d70f95b645bbdfcc00f306ce16d | payload | 2026-09-04 | 95% |
| sha256_hash | f650d42dc1d33f8e776b9eadbc7f8789868b20d97b48d1d2338532ba81d36337 | payload | 2026-09-04 | 95% |
| sha256_hash | 966b1fea9cdc54843a728b1a870bfb7d2f8109085b6114455d6e2635ab1ad40f | payload | 2026-09-04 | 95% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["134.122.187.74"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["134.122.187.74"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - ValleyRAT
let malicious_hashes = dynamic(["3c143cde7d767aba3024349739d9d708", "ae42cc9a3b33728a7e3cbf98a251ec2782b4f4b5", "dc4054f1ff61a001d3d872ae280b3208", "1055656b4243a6f96db475f0fd2f8506a944f65eaea22789c409220b2b82040b", "0dd128e087b0740d6cb86c502815d9b6697fc80b", "6572fd0e50094c7f2ff4aa7267893ec09853b3e4", "ee532fd47952c2b5ad8cb3cd3a92757d", "50f8064aa9924f674b5b7d24d1562f35f11007cc8ef57a7a3ce07e0f713efba1", "e584cc74edc4bee1b7808ec6c287a24376a8e05d", "6ac22b0b445d781a3b104ed39d3f7693", "13b5ce5838356cffbb328312b4509eef0662d2d3434b683f177bb0aaf8281b9c", "a7c737cd5dee4c165d2e0d5a44b256340f89db58", "f2d73d70f95b645bbdfcc00f306ce16d", "f650d42dc1d33f8e776b9eadbc7f8789868b20d97b48d1d2338532ba81d36337", "966b1fea9cdc54843a728b1a870bfb7d2f8109085b6114455d6e2635ab1ad40f"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
Scenario: A DevOps engineer uses ValleyRAT as a lightweight, open-source remote administration tool for troubleshooting a specific legacy application server that lacks native agent support. The tool’s default configuration or a custom script may generate network connections or file artifacts matching the IOCs (e.g., specific TCP ports, file hashes, or registry keys).
powershell.exe or cmd.exe initiated by a known service account (e.g., svc-devops) and the destination IP is within the internal management subnet (e.g., 10.20.0.0/24). Alternatively, whitelist the specific file hash of the ValleyRAT binary if it is stored in a designated tools directory like C:\Tools\ValleyRAT\.Scenario: An IT administrator performs a scheduled backup or disk imaging task using a third-party tool that internally leverages ValleyRAT components or shares similar binary signatures due to common open-source libraries. The IOC matching is based on file hash or memory signature, causing a false positive during routine maintenance windows.
Veeam.exe, Acronis.exe, or wbadmin.exe). Additionally, exclude if the file path contains \\BackupShare\ or C:\Temp\Backup\.Scenario: A security team conducts a tabletop exercise or red team simulation using ValleyRAT to test endpoint detection coverage. The tool is run from a staging server or a dedicated test VM, but its IOCs (such as specific DNS queries or TCP connections to a C2-like internal IP) are not fully isolated from production monitoring.