154[.]92[.]16[.]22

Posts referencing this indicator

• An Analysis of ValleyRAT Infection Campaigns from Fake Installers, Japanese Malicious Emails

  SSpiderlabs

  ValleyRAT payload download server; hosts xz.bin which is the RC4-encrypted ValleyRAT shellcode downloaded by the malicious DLL

  2026-07-06