ValleyRAT

Silver Fox distributes these malicious applications through various channels, including SEO poisoning campaigns, phishing emails, and compromised software installers for popular applications like Chrome, VPN clients, and AI tools.

A fake repository impersonating OpenAI’s Privacy Filter tool climbed to the top of Hugging Face’s trending list last week... Attackers cloned its documentation almost word-for-word, creating a mirror repository that looked credible enough to fool experienced developers at first glance.

Silver Fox has emerged as a significant cybersecurity concern, leveraging trojanized medical software to infiltrate healthcare organizations and public sector entities.

The attacker uses localized phishing lures crafted to appear as payroll notices, tax audits, VAT filings, government compliance notices, invoices, and human resources communications.

The group sends carefully crafted emails disguised as messages from HR departments, tax authorities, and payroll teams... Once a victim clicks a link or opens an attachment, the malware silently installs itself.

A tax-themed phishing email impersonates HMRC, and a benefits-themed phishing email uses a shortened link to send recipients to download malware.

To evade detection, the malware configures Windows Defender exclusions using PowerShell commands

Winos4.0 is a well-documented C2 framework... [with] Remote shell access and command execution

The attack begins with a trojanized executable, such as MediaViewerLauncher.exe, which mimics the legitimate Philips DICOM viewer software.

In the previous versions of ValleyRAT, configuration data, including the encoded C2 domain were likely written to HKCU\SOFTWARE\IpDates_info and a secondary key at HKCU\Console\0\451b464b7a6c2ced348c1866b59c362e stores encrypted binary data likely used for malware configuration or payload staging.

The sideloaded Utility.dll establishes persistence by creating a service named _CCGDAT, configured to start automatically when the system boots.

Following decryption, the loader allocates memory within the current process and writes the decrypted shellcode into it. Execution is then transferred using CreateThread, allowing the payload to run entirely in-memory.

The second stage focuses on disabling endpoint security through a Bring Your Own Vulnerable Driver (BYOVD) attack, loading the TrueSightKiller driver (189atohci.sys) to terminate antivirus processes using DeviceIoControl with IOCTL 0x22e044.

Access Token Manipulation: Create Process with Token - T1134.002 5 out of 18 malware families manipulate the process token to gain greater control over other processes on the system.

The sideloaded Utility.dll establishes persistence by creating a service named _CCGDAT, configured to start automatically when the system boots.

Both the second stage loader and the third stage payload implement API hashing to resolve Windows API functions at runtime. Instead of storing API names in plain text, the malware computes hashes and dynamically matches them against exported functions from loaded modules.

The websites closely mimic the legitimate Microsoft Teams download page, using lookalike domains to trick users into downloading a trojanized installer packaged as a zip archive.

Following decryption, the loader allocates memory within the current process and writes the decrypted shellcode into it. Execution is then transferred using CreateThread, allowing the payload to run entirely in-memory.

The second stage focuses on disabling endpoint security through a Bring Your Own Vulnerable Driver (BYOVD) attack, loading the TrueSightKiller driver (189atohci.sys) to terminate antivirus processes

During analysis, a call to SetFileAttributes was observed with the value 7 which made the copied folder hidden.

Access Token Manipulation: Create Process with Token - T1134.002 5 out of 18 malware families manipulate the process token to gain greater control over other processes on the system.

A primary shellcode payload user.dat is dropped by Installer in an AES encrypted form. During runtime, the malware performs decryption in memory before execution.

После загрузки DLL-модуль распаковывает архив с помощью методов COM... Скопировав файлы, скрипт запускает Python-модуль appclient с помощью легитимного инструмента pythonw.exe

Post decryption, the payload consists of a shellcode loader followed by a fully functional ValleyRAT module. The loader uses Reflective Loading techniques to map the PE into memory.

In the previous versions of ValleyRAT, configuration data, including the encoded C2 domain were likely written to HKCU\SOFTWARE\IpDates_info and a secondary key at HKCU\Console\0\451b464b7a6c2ced348c1866b59c362e stores encrypted binary data likely used for malware configuration or payload staging.

Atlas RAT has the following capabilities... Start a keylogger

The system reconnaissance phase utilizes native Windows utilities including cmd.exe, ping.exe, and ipconfig.exe to assess system properties and network connectivity.

Atlas RAT has the following capabilities... Start a keylogger

This suggests that the RAT maintains a local buffer of collected data before exfiltration to its command and control server.

The malware actively monitors user activity by accessing clipboard contents through the GetClipboardData API.

Atlas RAT has the following capabilities... Record audio and video (webcam)

Atlas RAT has the following capabilities... Record audio and video (webcam)

Upon visiting the site, users are prompted to download a compressed archive named as: 98653.2.87.teamsx.zip ...

Atlas RAT ... connected to a command-and-control server at 206.238.115.58 over port 886... Network defenders should flag traffic to unusual ports, particularly port 1234, used by RomulusLoader’s C2 infrastructure.

Using jsonkeeper[.]com (a public JSON paste service) as the C2 channel lets the attacker rotate the payload without modifying the repository.

The intricate ARQ handshake routine does, however, allow for hole punching in firewalls, aka “NAT traversal”, which enables the protocol to be used for peer-to-peer communication. This p2p-enabling property could potentially be used to relay C2 communication through one or several bots, even if those bots are behind separate NAT firewalls.

Gh0stKCP is a transport protocol based on KCP, which runs on top of UDP... From this point on Gh0stKCP communicates using the KCP protocol, with the exception that each end transmits packets using their own conversation ID rather than a common ID.

ValleyRAT, built on the Winos4.0 framework, adds DDoS support and downloads additional modules on demand.

TA4922 might use a remote access Trojan (RAT), like ValleyRAT or Atlas RAT, to access targeted systems, or legitimate remote monitoring and management (RMM) software, like AnyDesk. In the latter case, it'll use a loader called RomulusLoader to bring the RMM onto the host system.

As a first step the malware after execution weakens the system’s defenses by modifying the Windows Defender settings.