ValleyRAT Campaign Targets Windows via WeChat and DingTalk

A sophisticated Windows remote-access trojan known as ValleyRAT has emerged as a high-confidence indicator of targeted intrusions against Chinese-language users and organizations.ValleyRAT’s operational model relies on a carefully orchestrated delivery chain comprising four distinct components: the downloader, loader, injector, and RAT payload.First observed in early 2023, this multi-stage malware combines advanced evasion techniques, aggressive privilege escalation, and targeted execution logic to establish persistent footholds on victim systems while evading security defenses.This modular architecture enables operators to maintain stealth throughout the attack chain through in-memory decryption and living-off-the-land execution techniques.The malware leverages legitimate Windows binaries, particularly MSBuild.exe, as execution hosts to disguise its presence as trusted system processes.ValleyRAT demonstrates an unusual level of targeting sophistication through its implementation of a geographical kill switch mechanism.Upon execution, the malware queries the Windows Registry for the presence of two popular Chinese communication applications: WeChat and DingTalk.If both registry entries (HKCU\Software\DingTalk and HKCU\Software\Tencent\WeChat) are not found, the malware assumes it’s running outside its intended operational environment and immediately terminates execution while displaying a misleading error message.This targeted approach distinguishes ValleyRAT from commodity malware variants and indicates operators conducting highly focused campaigns rather than opportunistic attacks.The malware also implements an anti-duplicate-instance check by attempting to create a named mutex labeled “TEST,” preventing multiple instances from running simultaneously on compromised systems.Targeted Execution Logic.Security researchers treating ValleyRAT detections as high-confidence indicators of targeted intrusions rather than casual infections have identified this kill switch as a key indicator of deliberate operational security measures employed by sophisticated threat actors.Multi-Vector Privilege EscalationOnce ValleyRAT’s environmental checks pass, the malware immediately pursues administrative access through multiple user account control (UAC) bypass techniques.The malware exploits known Windows executables, including CompMgmtLauncher.exe, Event Viewer, and Fodhelper.exe, by manipulating both file and registry entries in user-writeable locations.The most notable technique involves associating the ms-settings ProgID with custom file extensions in HKCU\Software\Classes, redirecting execution flow when legitimate Windows tools are launched.ValleyRAT additionally manipulates its security token to enable SeDebugPrivilege, granting the malware unprecedented control to interact with, inspect, and terminate processes belonging to other users or higher integrity levels.Access Token Manipulation.After securing elevated privileges, ValleyRAT systematically dismantles security defenses by targeting an exhaustive list of anti-virus and host-based intrusion prevention system executables, predominantly from Chinese vendors including Qihoo 360, Tencent QQ PC Manager, and Kingsoft.VendorTargeted Executables (Examples)Qihoo 360360d.exe, 360Safe.exe, 360Tray.exeTencent QQQQPCRTP.exe, QQMPersonalCenter.exeKingsoftkxscan.exe, kwsprt.exe, kxascore.exeThe malware uses the CPUID instruction to verify processor vendor strings, checking for “GenuineIntel” or “AuthenticAMD” identifiers often spoofed in virtual environments like VMware or VirtualBox.The malware terminates these processes before proceeding and modifies security software registry settings to turn off their autostart capabilities.Sophisticated Anti-Analysis ValleyRAT employs robust anti-analysis techniques to evade both sandbox environments and researcher investigation.Through the Picus Threat Library, it replicates the tactics, techniques, and procedures (TTPs) observed in these campaigns.Threat IDThreat NameAttack Module29426ValleyRAT Malware Downloader Download ThreatNetwork Infiltration25204ValleyRAT Malware Downloader Email ThreatEmail Infiltration59821ValleyRAT Loader Download ThreatNetwork Infiltration54856ValleyRAT Loader Email ThreatEmail Infiltration72873ValleyRAT Malware Dropper DownloadNetwork Infiltration46588ValleyRAT Malware Dropper Email ThreatEmail InfiltrationAdditionally, the malware enumerates running windows and checks their title strings against known analysis tools including Wireshark, Fiddler, Malwarebytes, ApateDNS, and TaskExplorer.To ensure persistent execution across system reboots, ValleyRAT writes its execution path to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run using a deceptive value name, GFIRestart32.exe.The malware also copies itself into the Startup folder as Appcustom.exe, establishing multiple persistence vectors.Before contacting its command-and-control server, ValleyRAT performs an initial Internet connectivity check against hxxp://www.baidu.com, then generates a randomized integer to construct a dynamic beacon string sent to the C2 infrastructure.This dynamic approach aids in network-based evasion by preventing static detection signatures from identifying command-and-control communications.Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.

Based on reporting by GBHackers.