ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt hypothesis targets adversaries utilizing ValleyRAT Remote Access Trojans delivered through phishing campaigns to establish persistent access for data exfiltration and remote command execution. Proactively hunting for these indicators in Azure Sentinel is critical to identify early-stage infections before attackers can leverage the Trojan’s stealth capabilities to compromise sensitive assets undetected.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 3 IOC Types: md5_hash, sha256_hash, sha1_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ValleyRAT
let malicious_hashes = dynamic(["afc61229018541efa19cd9affa1aeb72", "98f5e6cc01bd74709e63639e75a6e4d68b6c5fb9654ae97490155792888bebdd", "b6cbc4017ed864b21917e3604c6e5f57d2e9ed0a"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

False Positive Scenarios: ThreatFox: ValleyRAT IOCs

• Scenario 1: Automated Phishing Simulation Campaigns

  • Context: Security teams frequently run internal phishing simulations using platforms like Proofpoint or KnowBe4. These campaigns often distribute test emails with attachments (e.g., .docx, .pdf) that mimic the payload structure of ValleyRAT to train users. If these simulation tools use similar file hashes or network signatures as the actual malware, they trigger false alerts.
  • Suggested Filter: Exclude traffic and process execution originating from the internal IP ranges of the security awareness platform (e.g., Source_IP IN [10.20.50.0/24]) where the user agent or sender domain matches known simulation domains (e.g., @simulation.internal.com).

• Scenario 2: Scheduled RMM Agent Updates

  • Context: Enterprise Remote Monitoring and Management tools like SolarWinds N-central, ManageEngine Desktop Central, or Tanium perform scheduled background updates. These agents often deploy new binaries or scripts via a mechanism that resembles the “phishing attachment” delivery vector of ValleyRAT, specifically when they install patches on endpoints during off-hours.
  • Suggested Filter: Create an exclusion for processes spawned by specific RMM service accounts (e.g., User_Name = 'svc_rmm_update') and filter out file hashes that match the known signature list of the organization’s primary RMM tool version.

• Scenario 3: Legitimate Document Sharing via Enterprise Collaboration Suites

  • Context: Business units regularly share complex documents containing embedded macros or active attachments through Microsoft Teams, SharePoint, or Google Workspace. When a user opens a document with an attached macro-enabled file (common in finance and HR departments), the behavior of loading external resources