ValleyRAT Malware Campaign Expanded over Phishing Notifications and Executable Files

EXECUTIVE SUMMARY:

A malware campaign has been observed distributing the ValleyRAT remote access trojan (RAT) through two primary infection vectors: fraudulent software installers and malicious email messages. The campaign relies heavily on social engineering techniques, tricking victims into executing seemingly legitimate files that ultimately deploy the malware. While the lures primarily target Chinese- and Japanese-speaking users, organizations with international operations remain at risk because attackers frequently exploit regional offices and trusted business communications to gain initial access.[emaillocker id="1283"]

The attack chain begins when victims download a fake installer or access a ZIP archive delivered through a malicious email link. The archive contains a legitimate executable paired with a malicious DLL, enabling DLL sideloading to initiate the infection process. The malicious DLL establishes persistence by copying files to system directories, downloading the ValleyRAT payload, and executing it directly in memory using fileless techniques. The malware incorporates multiple defense-evasion mechanisms, including code obfuscation, memory size validation, sleep timing verification, process count checks, and environment detection to avoid execution within analysis sandboxes. Once active, ValleyRAT enables remote system control, maintains persistence through registry modifications, and leverages encrypted payloads and in-memory execution to reduce detection by conventional security solutions.

The ValleyRAT campaign demonstrates a combination of social engineering, stealthy malware delivery, and advanced evasion capabilities that complicate detection and incident response. Organizations should strengthen email security controls, restrict the execution of untrusted archives and executables, deploy endpoint detection and response (EDR) solutions capable of identifying DLL sideloading and memory-resident threats, and provide regular user awareness training to reduce the likelihood of successful compromise. Continuous monitoring and proactive threat hunting remain essential for identifying and containing ValleyRAT-related activity before attackers can establish long-term access.

THREAT PROFILE:

MBC MAPPING:

REFERENCES:

The following reports contain further technical details:

https://cybersecuritynews.com/hackers-use-fake-vlc-executable/

https://www.levelblue.com/blogs/spiderlabs-blog/an-analysis-of-valleyrat-infection-campaigns-from-fake-installers-japanese-malicious-emails