medium
advisory
ValleyRAT Remote Access Trojan Activity
New infrastructure and payloads associated with the ValleyRAT remote access trojan were observed in the wild on 2026-11-04.
Triage facts
Revision 1- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 2 public sources
- Freshness
- Revision 1Nov 5, 13:42 UTC
- Detection
- 2 IOCs
- Source quality
- A1Likely
Threat intelligence monitoring identified five new indicators of compromise related to the ValleyRAT remote access trojan on November 4, 2026. This activity includes three unique file hashes associated with the malware payload and two active command-and-control (C2) ports on the same remote IP address. ValleyRAT typically functions as a remote access tool providing attackers with persistent system control.
Recommendation
- Block all outbound network traffic to the IP address 202.95.13.142 on ports 8888 and 6666 at the perimeter firewall.
- Implement file hash blocking or alerting for the provided MD5 and SHA-256 signatures on all managed Windows endpoints using an EDR or anti-malware solution.
- Hunt for internal hosts that have established successful TCP connections to the identified C2 ports within the last 30 days.
Immediate actions
Block infrastructure IOCs at perimeter firewall
SOC
24h
Threat Hunt
Identify endpoints communicating with the C2 IP range
T1071.001
high
high confidence
hunt now
Data: firewall_logs, proxy_logs
Indicators of compromise
1
hash_md5
1
hash_sha256
| Type | Value |
|---|---|
| hash_md5 | 32f5f12dc1dc85423f2add8052adfeb6 |
| hash_sha256 | 9a02a157acf5643e7ba6bcb422f093f7a681c184fcfa285c568e27803762dc49 |