Loading malware…
ValleyRAT, also referred to as Winos 4.0 or WinOS 4.0 in overlapping reporting, is a multi-stage Windows remote access trojan associated in multiple investigations with the Silver Fox threat ecosystem and broader Gh0stRAT-derived tooling. It has been active since at least 2023 and has been used in campaigns targeting Chinese- and Japanese-speaking users, Indian tax-related targets, and other victims through socially engineered delivery chains. Reported lures include tax-themed phishing, trojanized software installers, fake browser installers, and abuse of legitimate applications for DLL sideloading, including VLC-based chains. Some campaigns also used malicious disk images or compressed archives as intermediate stages.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
"It's worth noting that the NSecKrnl driver is susceptible to a known security flaw (CVE-2025-68947, CVSS score: 5.7) that could be exploited to terminate arbitrary processes."
14 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Howler Cell identified a new 32-bit malicious installer disguised as a Google Chrome installer, which kickstarts a multi-stage delivery chain, ultimately deploying the ValleyRAT remote access trojan.
The malware, tracked as ValleyRAT, is deployed by a hacking group known as SilverFox, and it stands out for one reason: it refuses to stop at just one payload.
Seqrite said it identified infrastructure and tactical overlaps with Silver Fox, a Chinese cybercrime group previously attributed to tax-themed phishing campaigns that deliver ValleyRAT.
The results of the IDS-rules detection are compatible with Win32/ProcessKiller, Winos4.0 and Backdoor SilverFox which both have the alias ValleyRAT.
The threat actor also attempted to use a downloader built using the advanced malicious framework Winos4.0. The downloader, placed under drivers\etc masquerading as hosts.exe, attempted to connect to the IP address 154.201.68[.]57. After a successful connection, it downloads the payload and saves it into the registry key d33f351a4aeea5e608853d1a56661059. It then executes the payload.
Finally, this Proofpoint cybercrime analysis notes that the threat group continues to abuse the open-source Winos4.0 framework. In early 2026, researchers spotted a heavily modified variant featuring a massive codebase expansion.
32 distinct techniques documented for this family, organized by ATT&CK tactic.
During execution, the script uses the PowerShell Add-MpPreference cmdlet to create a Microsoft Defender exclusion for the target folder where additional malicious files are staged.
After extracting additional components, man.exe launches bypass.exe using the WdcRunTaskAsInteractiveUser method. This API is resolved dynamically at runtime using GetProcAddress.
The attack chain employs social engineering and counterfeit domains to trick users into downloading malicious ZIP archives.
2. Initial Access - Drive-by Compromise (T1189) + Malicious Link (T1204.001) Пользователь находит отравленный результат в поиске и переходит по ссылке.
3. Execution - Malicious File (T1204.002) / PowerShell (T1059.001) ... Запуск NSIS-инсталлятора с недействительным сертификатом - кампания ASEC (KakaoTalk) Загрузка архива с "юридическим шаблоном" - GootLoader
Finally, a kernel rootkit is installed, supporting more than 65 command codes and taking instructions from the RAT through named pipes... Additional plugins can be pushed to victims after infection, again delivered through named pipes
The content is then read from the registry and injected into a newly spawned tracerpt.exe process via the Thread Execution Hijacking technique.
the final one drops a kernel level rootkit that takes direct orders from the RAT itself... Finally, a kernel rootkit is installed
These include a legitimately signed Google Chrome installer and several archived and encrypted components used to carry out malicious activity in the background... Password-protected 7-Zip archive... RC4-encrypted PE file.
Once running, the malware disables logging tools and antivirus scanning before hiding its next payload inside the pixel data of ordinary looking PNG images. That image based hiding technique, known as steganography, repeats at multiple points in the chain.
the group's operations may appear unsophisticated due to the use of SEO poisoning and counterfeit software installers... employing fake software installers
4. Defense Evasion - Match Legitimate Name or Location (T1036.005) Вредоносные домены и файлы маскируются под легитимные. Кампания EclecticIQ использует дополнительный приём: параллельная установка настоящего npm-пакета маскирует вредоносную активность.
The content is then read from the registry and injected into a newly spawned tracerpt.exe process via the Thread Execution Hijacking technique.
After completing the attack chain, man.exe creates a batch file named delete_self.bat to remove all files it had dropped during execution.
The purpose of this executable is to read an encrypted file named Windows.log and decrypt it using a custom RC4 key... After decryption, a DLL ... is loaded into memory.
Once launched, it performs checks to avoid executing within analysis and sandboxed environments
It monitors the clipboard for cryptocurrency wallet addresses and swaps them with ones controlled by the attackers
581 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
151 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Winos 4.03
Backdoor/RAT delivered via fake KakaoTalk installers in an SEO-poisoning campaign; provides full remote control including screenshots, system information collection, file management, and arbitrary code execution via C2.
Remote access trojan delivered via a government-themed social engineering campaign using a multi-stage infection chain with malicious VHDX, DLL sideloading, encrypted in-memory payload execution, runtime string decryption, API hashing, process injection, registry persistence, and dynamic download of additional encrypted modules from its C2 server.
A multi-stage remote access malware family used by SilverFox. It uses an eight-stage infection chain with DLL sideloading, steganography in PNG images, in-memory shellcode loading, AV-disabling capability, WebSocket/QUIC C2, and a final kernel-level rootkit controlled by the RAT via named pipes. It also steals data, monitors and swaps cryptocurrency wallet addresses in the clipboard, targets Telegram data, and supports additional plugins for tailored post-compromise activity.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.