Skip to main content

ValleyRAT

Malware Family

4 165 indicators of compromise attributed to ValleyRAT across abuse.ch threat intelligence feeds.

Domains

156

IPs

522

URLs

47

Hashes

3 440

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (156)IPs (522)URLs (47)Hashes (3 440)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&Cpayload

Sample indicators

IndicatorType
zzlkkghnmh.cndomain
kkvbyroasdr.cndomain
qn.ios163.comdomain
teamszs.comdomain
windowas.comdomain
j6fadacai.comdomain
koeuisg.cndomain
cqbxbkj.cndomain
cc.92lu1.ccdomain
uujhgtbbh.cndomain
bifa668.comdomain
sy336556254c.qpondomain
btc23556gvbvc.cyoudomain
2844.xzz.camdomain
bei.tfuuuk.comdomain
qd8jh2n.comdomain
dv.yuxuanow.comdomain
xiaoshihou40.orgdomain
404xh.comdomain
pishjdaagd.cndomain
27.124.18.107ip
18.167.189.134ip
8.217.130.185ip
156.239.225.187ip
103.118.243.73ip
136.0.5.4ip
103.199.102.28ip
38.181.2.70ip
47.236.232.206ip
47.84.32.184ip
27.124.34.146ip
154.91.64.48ip
43.251.224.7ip
45.197.237.53ip
192.252.181.4ip
202.79.169.251ip
103.27.79.47ip
82.158.89.252ip
47.239.19.194ip
43.198.220.74ip
https://withered-lake-8596.krzakanna172.workers.dev/url
http://withered-lake-8596.krzakanna172.workers.dev/url
https://divine-shape-b4fb.erinbraumbachlianebl.workers.dev/url
https://mt-link.qdhuzf.cc/cl/rlLXIXSwv8IKS9aWzYqx.GteIY.dfPLTRPY013hMjghjIqNPZYu0.3GRfdJuvkQ6tE_bREwYxiJYCce5tvEnoE3KBUTwvCDTiu2bDHWXZs0x1W9uo0iVh.1QNGRtX1FCHw7RAGf7rgebqPkGAHTMO9PNVObFPz6ZweWWMF.A8WcBWExrFhKajHLSIXt2Nztt0U74bljpjJsEHOma6bAX63E8oWmZHpihcBw2sQ~~--2IJbf9QXryunJZJU--8Oh.0r5JKH3jZkGT7hZ3yQ~~url
https://lively-fog-72fd.piecestrengthen3327.workers.dev/url
http://wwnbslklfdsrf.cn:8880/getinstall64url
https://kaiwyrey.eu.cc/d/bdc9637e70c2url
https://restless-wood-acdc.kubataffeltie470.workers.dev/url
http://kaiwyrey.eu.cc/d/bdc9637e70c2url
http://gxfsxs.cn:8880/getinstall64url
http://45.91.226.120/getinstall64url
https://mt-link.qdhuzf.cc/cl/a5UYfW_dao7L4uK02Y5e3T4RKwwLAq7x5FXAtyV8o3UJAUT_K5Ia0VIbWVrxBLXMNGzEK9WhhAhSQFoBqqCupKzzInKiHGMgGOcp1Yiigbo6JUPzwHm0YBF._JurP0LhKB4wt0m5H1gYc3aG149V2da397unkY11uVn30sF8DGJJMiZtmJS_UGZtI_JqupELrUzGNWj2gvSMSOq9_0IdaVJwLmuBiwllpHaogXqN4cKH--rCZGX49Rzqev4iXM--N6CY14rgI..iNc2Atg5k9g~~url
http://43.199.224.15/getinstall64url
http://gaotlix.cn/getinstall64url
http://149.30.222.4/getinstall64url
https://frosty-tooth-517b.erinbraumbachlianebl.workers.dev/url
http://43.198.235.91/getinstall64url
https://icy-mountain-13d6.hazukashi4816.workers.dev/url
https://mt-link.hxnxajp.club/cl/1tI4_QY7DCeBkEln5kmk9jrSOzkvCGnqOfOF.bP_ka4kNqy51He4r8IRtwhlZ2I_O_2nU1KmVVSZh_zV7BAOwQDLryYzqpE8R_QSdcIQel3f70U7Skywz.3B98ZVFhCxcdZMSYEd7RUj5.hif56qVudA9TU0yYiHnpS9u9fRMFRUpUFU4WNZg58wPV.jZgunKFKSrVPKboquHgJkbIYtGq_rfPM.1ldbJbc~--NuCyngcfq.n1c.5q--k8naVtPRTZtZg9yGwu3P8g~~url
https://sweet-thunder-52f5.yenthi893197.workers.dev/url

Another file to check? Run a file hash reputation check.