ValleyRAT Mimic as LINE Installer Attacking Users to Steal Login Details
A recent malware campaign involves the distribution of the ValleyRAT backdoor, disguised as a legitimate installer for the LINE messaging application. This attack mainly targets Chinese-speaking users, using a deceptive executable to infiltrate systems…
A recent malware campaign involves the distribution of the ValleyRAT backdoor, disguised as a legitimate installer for the LINE messaging application. This attack mainly targets Chinese-speaking users, using a deceptive executable to infiltrate systems and compromise sensitive login credentials.
The malware employs a complex loading chain, involving shellcode execution and legitimate system binaries, to evade detection and maintain long-term surveillance on the victim's machine.
Upon execution, the fake installer initiates a multi-stage infection process designed to bypass endpoint security controls. It attempts to neutralize Windows Defender by using PowerShell commands to exclude entire system drives from antivirus scanning protocols.
The malware deploys a malicious library, intel.dll , which conducts environmental checks such as file locking and mutex creation to determine if it is running within a sandbox environment. If deemed safe, the malware unpacks its primary payload, compromising the device fully.
A recent malware campaign involves the distribution of the ValleyRAT backdoor, disguised as a legitimate installer for the LINE messaging application.
Cybereason analysts have identified this campaign and noted the use of the advanced PoolParty Variant 7 injection technique, which hides malicious activity within trusted system processes. By abusing Windows I/O completion ports, the malware injects code into legitimate processes, ensuring stealth operation while harvesting user credentials and maintaining communication with command-and-control servers.
Advanced Injection and Persistence Mechanisms
The ValleyRAT variant exhibits technical complexity through its evasion and persistence strategies. It injects code into Explorer.exe and UserAccountBroker.exe , using the latter as a watchdog to ensure malicious components remain active. This injection manipulates system handles via specific Windows APIs like ZwSetIoCompletion to execute code within the memory space of trusted processes.
Additionally, the malware scans for security products from vendors like Qihoo 360 and terminates their network connections to disable local defenses. To maintain persistence, it registers scheduled tasks via Remote Procedure Call (RPC) protocols, ensuring automatic execution upon user login. It uses a digital certificate issued to "Chengdu MODIFENGNIAO Network Technology Co., Ltd" to appear legitimate, although the signature is cryptographically invalid.
To prevent infection, users should only download installers from official sources. Security teams are advised to configure detection rules to flag invalid certificates and monitor for suspicious child processes spawned by Explorer.exe , such as UserAccountBroker.exe , indicating potential process hollowing activity.
Based on reporting by Cyber Security News.