ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt detects adversary behavior involving the deployment of ValleyRAT remote access trojans by monitoring traffic and endpoint logs against a curated set of 18 specific indicators of compromise. A SOC team should proactively hunt for these IOCs in Azure Sentinel to identify early-stage lateral movement and data exfiltration attempts that may evade standard signature-based detection, thereby reducing the dwell time of this high-severity threat.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 18 IOC Types: md5_hash, sha1_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
sha256_hash	`e9d0b90379f9b64634720a9b1a6bf719a725f671b790bb65e340e0658cb516de`	payload	2026-08-22	95%
sha1_hash	`1db584321f36523ef893b4075f7afd24a2b70d96`	payload	2026-08-22	95%
md5_hash	`6df2733557d5247509c63cbf3e9f9fb1`	payload	2026-08-22	95%
sha256_hash	`0dfb74014c60e953d505c76ab981c55f90ab42f2ced57f34e4fa18cd69f83b99`	payload	2026-08-22	95%
sha1_hash	`5afddea028b72ef576afd99ca00de5ca10f3e1dc`	payload	2026-08-22	95%
md5_hash	`58ab824b14b2f31813afeea4caa5bd0d`	payload	2026-08-22	95%
sha256_hash	`0299c02d7a8f75eff82dc8de30997b3f81ce887efa8b75a96315a49c0b70975f`	payload	2026-08-22	95%
sha1_hash	`f4376aaf2c849fe3a5240140c62d7ad8e6896639`	payload	2026-08-22	95%
md5_hash	`880c2ae254a73ccc92d747de5993e976`	payload	2026-08-22	95%
sha256_hash	`fff9f02f3e58b940b9f1b628eda3d4463e17baf810b75f0cbd078952ad1ba969`	payload	2026-08-22	95%
sha1_hash	`1172046258a6bab6a26eb7c6ad19e8567e6a3378`	payload	2026-08-22	95%
md5_hash	`8799d7664ef577e5904a49d75c610615`	payload	2026-08-22	95%
md5_hash	`89f61b8bb4fa4229f6f18fab9e3a0a64`	payload	2026-08-22	95%
md5_hash	`04e3a5e74513b7cc7eb540940299806e`	payload	2026-08-22	95%
sha256_hash	`65856b5986156143dbedada62799e8b3b18db753f9d519710654b72f2f051d54`	payload	2026-08-22	95%
sha1_hash	`103ea93f99fef644afb443b5621e596e58a44b9e`	payload	2026-08-22	95%
sha256_hash	`5acbb6ee89b38eb2abf81a2b2349a4c97e7c2dd23ad4daf8d5b5b113176fef53`	payload	2026-08-22	95%
sha1_hash	`002048e6ec82b326fe6bae4b6bac64de8e545026`	payload	2026-08-22	95%

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ValleyRAT
let malicious_hashes = dynamic(["e9d0b90379f9b64634720a9b1a6bf719a725f671b790bb65e340e0658cb516de", "1db584321f36523ef893b4075f7afd24a2b70d96", "6df2733557d5247509c63cbf3e9f9fb1", "0dfb74014c60e953d505c76ab981c55f90ab42f2ced57f34e4fa18cd69f83b99", "5afddea028b72ef576afd99ca00de5ca10f3e1dc", "58ab824b14b2f31813afeea4caa5bd0d", "0299c02d7a8f75eff82dc8de30997b3f81ce887efa8b75a96315a49c0b70975f", "f4376aaf2c849fe3a5240140c62d7ad8e6896639", "880c2ae254a73ccc92d747de5993e976", "fff9f02f3e58b940b9f1b628eda3d4463e17baf810b75f0cbd078952ad1ba969", "1172046258a6bab6a26eb7c6ad19e8567e6a3378", "8799d7664ef577e5904a49d75c610615", "89f61b8bb4fa4229f6f18fab9e3a0a64", "04e3a5e74513b7cc7eb540940299806e", "65856b5986156143dbedada62799e8b3b18db753f9d519710654b72f2f051d54", "103ea93f99fef644afb443b5621e596e58a44b9e", "5acbb6ee89b38eb2abf81a2b2349a4c97e7c2dd23ad4daf8d5b5b113176fef53", "002048e6ec82b326fe6bae4b6bac64de8e545026"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`DeviceFileEvents`	Ensure this data connector is enabled

References

ThreatFox — ValleyRAT

False Positive Guidance

Here are 4 specific false positive scenarios and corresponding exclusion strategies for the ThreatFox: ValleyRAT IOCs detection rule in an enterprise environment:

Scenario: Legitimate EDR Telemetry Collection
- Context: The primary Endpoint Detection and Response (EDR) agent, such as CrowdStrike Falcon or Microsoft Defender for Endpoint, periodically scans the network to update its local threat intelligence database. This process often generates network traffic matching specific ValleyRAT IOCs (e.g., specific User-Agent strings or beacon intervals).
- Filter/Exclusion: Exclude traffic originating from the EDR service account (e.g., SYSTEM or a dedicated svc_edr_agent) and restrict the rule to exclude ports commonly used by the EDR vendor’s cloud communication (e.g., Port 443 to specific CrowdStrike or Microsoft IP ranges).
Scenario: Scheduled Backup Agent Communication
- Context: Enterprise backup solutions like Veeam Backup & Replication or Rubrik run scheduled jobs during off-hours. These agents establish persistent connections to the backup repository, utilizing network patterns (such as specific TCP handshake sequences and periodic heartbeats) that mimic the ValleyRAT command-and-control behavior.
- Filter/Exclusion: Create an exclusion rule based on the source hostname containing keywords like VeeamAgent or RubrikNode, and filter out traffic occurring during defined maintenance windows (e.g., 02:00 to 06:00 UTC) where these backup jobs are active.
Scenario: Third-Party Patch Management Scans
- Context: Automated patch management tools, such as Ivanti Neurons or ManageEngine Patch Manager, perform pre-deployment scans against the network to identify vulnerable endpoints. These scanners often inject probes that match ValleyR