Valleyrat

ValleyRAT is a multi-stage malware written in C++, first documented by Chinese cybersecurity firm Qi An Xin in February 2023. It harbors functionalities traditionally seen in remote access trojans, such as fetching and executing additional payloads (DLLs and binaries) sent from a remote server and enumerating running processes, among others. Upon execution of an embedded shellcode, the ValleyRAT DLL is reflectively loaded and executed in the system. A component then sends a request for the ValleyRAT payload downloader, highlighting the malware's primary purpose - to download the ValleyRAT payload. FortiGuard Labs recently encountered an ongoing ValleyRAT campaign specifically targeting Chinese systems. This configuration closely mirrors previously reported ValleyRat campaigns, containing the latest C2 servers and other settings for the RAT. The malware utilizes diverse techniques to monitor and control its victims and deploy arbitrary plugins to cause further damage. A unique feature of this campaign involves the malware sending 登录模块.dll_bin (translated as Login module.dll_bin) to request the ValleyRAT malware. While Gh0st RAT has been widely used in various cyber campaigns linked to China over the years, the emergence of ValleyRAT suggests it could be widely deployed in the future. The perpetrators behind these attacks are expected to continue using a mix of both older malware and the new ValleyRAT malware. The discovery of ValleyRAT underscores the evolving nature of cyber threats and the need for constant vigilance and robust cybersecurity measures.