ThreatFox: ValleyRAT IOCs

Hunt Hypothesis

This hunt detects adversary activity involving specific indicators of compromise (IOCs) linked to the ValleyRAT remote access trojan, which is known for establishing persistent backdoors and exfiltrating sensitive data from compromised endpoints. The SOC team should proactively search for these IOCs within Azure Sentinel to identify early-stage infections before the malware can escalate its capabilities or spread laterally across the network.

IOC Summary

Malware Family: ValleyRAT Total IOCs: 13 IOC Types: ip:port, sha256_hash, md5_hash, sha1_hash

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - ValleyRAT
let malicious_ips = dynamic(["118.107.9.185", "118.107.43.220", "47.86.2.244"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["118.107.9.185", "118.107.43.220", "47.86.2.244"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - ValleyRAT
let malicious_hashes = dynamic(["f5701fb674b20fdc997b7eba242ace9f8a314807", "ebbdc2815774b02394c688f9415325bb", "323574f16b63ebd05f097a572e8cf6e56efaa910", "8f4d337438eaf684b61e294ea52588f1", "875630fd7cae532e3700bec48bdd1c51ba7f133a595d4a62b94733f54073c62e", "1ab82089b52096ef768066cc619f1774801834221e22480411afa09e253461b4", "da6a114917bdb41286172fcaec6a05a3", "0d891499b453fec47129011c7160128223bbfabd", "7b1da0a6dc4eb9fc73d0e810677c2740cad5a1320fc5c9af00babf553ca2cebc"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

References

• ThreatFox — ValleyRAT

False Positive Guidance

Here are specific false positive scenarios and corresponding exclusions for the ThreatFox: ValleyRAT IOCs detection rule in an enterprise environment:

• Scenario: A legacy internal HR portal utilizes a Java-based reporting engine that periodically downloads configuration manifests containing a hash matching one of the ValleyRAT IOCs. This occurs nightly via the HR_Report_Scheduler service account on Windows Server 2019 nodes.

  • Suggested Filter/Exclusion: Create an exclusion rule in your SIEM (e.g., Splunk or Sentinel) to suppress alerts where the Source Host matches the HR server FQDNs and the Process Name is java.exe running under the specific service account svc_hr_reports.

• Scenario: The corporate endpoint protection suite (Microsoft Defender for Endpoint) performs a scheduled definition update that includes a shared library file (valley_core.dll) with a hash identical to a ValleyRAT IOC. This triggers on all workstations during the 02:00 AM maintenance window.

  • Suggested Filter/Exclusion: Configure an exclusion in Microsoft Defender for Endpoint (or your EDR console) to whitelist the specific file path C:\Program Files\Microsoft Defender\MpClient\valley_core.dll and exclude events occurring between 01:30 AM and 02:30 AM on weekdays.

• Scenario: A DevOps team uses a custom PowerShell script (Deploy_Valley_Config.ps1) to push configuration updates to the development cluster. The script extracts an archive containing a binary that matches a ValleyRAT IOC, triggering alerts during CI/CD pipeline runs in Azure DevOps.

  • Suggested Filter/Exclusion: Implement a logic filter to exclude events where the Parent Process Name is pwsh.exe or powershell.exe, the User Account belongs to the `