hxxp://154[.]92[.]16[.]22/xz[.]bin

Posts referencing this indicator

• An Analysis of ValleyRAT Infection Campaigns from Fake Installers, Japanese Malicious Emails

  SSpiderlabs

  ValleyRAT download URL contacted by the malicious DLL via wininet APIs; URL is Base64-encoded in the DLL and payload is RC4-encrypted with key 'zenzensu'

  2026-07-06