>samit_hota
Back to IOCs
44 indicators

ValleyRAT — Indicators of Compromise

Samit Hota·
#ioc#valleyrat

Overview

Indicators of compromise associated with ValleyRAT. 44 indicators listed below.

Not exhaustive, and confidence varies. Always corroborate against your own telemetry before taking action.

TypeIndicatorFirst SeenConfidence
ip:port103.119.3.160:6666July 18, 202675%
domainijt1.comJuly 18, 202675%
md5_hashc20a54cc45596e10f5eaf83a388128feJuly 16, 202695%
sha1_hash7fb8478bfa214c20a0d4ed26b293501d39c475bcJuly 16, 202695%
md5_hash3a85be4f475378e774b44aafd20102cdJuly 16, 202695%
sha256_hash04bc0dbf904d347bfa0b064bb436650fad0583b550dbd9450c8d00f4cb5a3b1bJuly 16, 202695%
md5_hash56ff460150b3ddeb5f1a01495ab44ee2July 16, 202695%
sha256_hash551854f430801e8352f6562a48077cb04f399cdc505b42f0daaa3ad61d0e9f62July 16, 202695%
sha1_hash9f4426b75d6dca82fb22a1f5ebfef3205ef78bcaJuly 16, 202695%
sha256_hasheee7db42470f6c58dc1e696ee937e87bd72f0cabe8df566021a79880d288e370July 16, 202695%
sha1_hashb524c7848c2599868c1a39d57f4bfb261d194197July 16, 202695%
urlhttp://43.198.235.91/getinstall64July 16, 2026100%
ip:port154.91.74.87:774July 16, 202675%
ip:port192.253.228.193:4412July 15, 202675%
ip:port192.253.228.193:4411July 15, 202675%
ip:port154.82.93.200:778July 15, 202675%
md5_hash0f3c2a17015bb0a23f6ea77eefaf2b2bJuly 15, 202695%
sha256_hash9a9d372cc821b6d2f7e30abb80aff7cae841703db0fb78bd859e6581420fbc07July 15, 202695%
sha1_hash0838936a59ac61612dc2937993ec1ae60f12c6dfJuly 15, 202695%
md5_hash0a9429738e11acea24949b0247b31ba2July 13, 202695%
sha256_hash1c82635c29f40e971971e150ebee6f36dabdd2a156f51214f20425315abb413fJuly 13, 202695%
sha1_hash6a08b69f2d8b331b829365e91611f201898817a7July 13, 202695%
sha1_hash842612a287011c76730a167a6cae7786aee760e8July 13, 202695%
md5_hashdd0634be42cda34fa24999471f418ad1July 13, 202695%
sha256_hash6546aad603716ebbe02412440e8d8d8e5fd7af80f212c6fe45e50a76f093c6d1July 13, 202695%
sha1_hash0607eb8418f7f08970c5c7439dfcf2fab2d82aceJuly 13, 202695%
md5_hashcb0c6801af564392ff22f3865cd31759July 13, 202695%
sha256_hash32146526cbc3e98467c0e6fbb684f489015e59bed6a4dcff756f6f82d787c5abJuly 13, 202695%
sha256_hashd11e793159f0da3c88a9ecebb8e5df88919843a1eeaaf71117377db58224a1aeJuly 13, 202695%
sha1_hash27476d28d66e08f6f1a2b9886ca53e3fff316f76July 13, 202695%
md5_hashb83b607adaa4e982a4dfa29c57306a0dJuly 13, 202695%
md5_hash026286f87e3719a78ade47685a01e31dJuly 13, 202695%
sha256_hash74dcd1f64bd3b43cf659359bff1f43131d43b4e07f3a3aa2a1f74d6e7970be09July 13, 202695%
sha1_hash26668a26d5eca6ecde87587b76b1e500cdf2f915July 13, 202695%
ip:port103.118.243.73:443July 13, 2026100%
urlhttp://95.40.222.37/getinstall64July 13, 2026100%
ip:port143.92.61.212:443July 13, 2026100%
ip:port103.12.149.93:443July 13, 2026100%
ip:port103.43.11.40:1443July 13, 2026100%
ip:port134.122.128.66:6666July 12, 202675%
ip:port134.122.128.66:8888July 12, 202675%
ip:port202.95.8.27:6666July 12, 202675%
ip:port202.95.8.27:8888July 12, 202675%
ip:port134.122.128.66:5050July 12, 202675%

Related content

IOCs

5.t Downloader — Indicators of Compromise

IOCs

ACR Stealer — Indicators of Compromise

IOCs

AdaptixC2 — Indicators of Compromise

IOCs

AdWind — Indicators of Compromise

Seeing these indicators in your logs?

Let's figure out how far it's gotten.

Book an advisory call