ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt identifies potential ValleyRAT infections by correlating known indicators of compromise, such as specific file hashes or network artifacts, against active endpoints in the Azure Sentinel environment. Proactively hunting for these IOCs is critical because ValleyRAT is a high-severity remote access trojan that enables persistent adversary control and data exfiltration, allowing the SOC to detect and contain threats before they escalate into broader lateral movement or ransomware deployment.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 15 IOC Types: sha256_hash, sha1_hash, md5_hash

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ValleyRAT
let malicious_hashes = dynamic(["f9b09befb30866b099222758b9dced1e58540c87", "c9dd06b54122a3c7b27299720b403a92", "b709d2521e36fb30edbddffff27e7a09a0aa2766cd98c6aea38c92bd1f953176", "2c760321782a419ada907cb66b2653f6e16ff17f", "cd4247e33148b91be70282885447f757", "64a0d5786d516194a42776f23e584a07d2c02080", "dd6920d9209ea1cdcbb9be9e2e605d57", "a58f5fe338e416dbc8cf88b0b3cabebc5ba2f6ae632e50e703127519331660fc", "089cd5a891a8f212df5f54a6b08205e06e85eacbe6ff9bfcfcb5fd6e51d1813b", "6a08e4e05a94347b02b0aef2aa2a695e859eb678", "6200240443329003bc9e2b3ddfbe34da", "39e5875573d0bcd3fd29c680ff0081b52b6c38e01edea4a2bd718b22884a4307", "b14b737c48708235edb9035cc09b35a9e0e888b25c8ee6959919fb6123810c81", "f9c83110b111ffbf8ff129c251dcdf1494504f99", "c87cdff96cf2f30bd7665a151e6ee3a5"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

• Scenario: A legacy Java-based application server (e.g., Tomcat or JBoss) is deployed with a custom valley.jar or similar artifact for internal microservice communication, where the filename or hash matches one of the 15 IOCs due to a shared build template or naming convention.

  • Filter/Exclusion: Exclude alerts where the file path contains \\tomcat\\ or \\jboss\\ and the parent process is java.exe or javaw.exe, provided the file is located in a standard lib/ or WEB-INF/lib/ directory.

• Scenario: An IT administrator manually copies a ValleyRAT sample (or a test binary named valley.exe) to a shared network drive (\\fileserver\IT_Shared\) for documentation or training purposes, and the file is accessed by multiple user workstations via SMB, triggering host-based file creation or access events.

  • Filter/Exclusion: Exclude events where the file path starts with \\fileserver\IT_Shared\ or \\fileserver\QA_Environment\, and the user account belongs to the IT_Admins or QA_Team security group.

• Scenario: A CI/CD pipeline (e.g., Jenkins or Azure DevOps) builds a test application that includes a dependency or test fixture named valley-rat-test.dll or similar, which is copied to the build agent’s temporary directory (C:\temp\ or C:\jenkins\workspace\) during the build process.

  • Filter/Exclusion: Exclude alerts where the file path contains C:\jenkins\ or C:\temp\ and the parent process is java.exe (Jenkins agent) or node.exe (Node.js build tool), and the event type is “File Created”