Loading malware…
ValleyRAT, also known as Winos4.0 or Winos 4.0, is a Windows remote access trojan associated in multiple investigations with Chinese-speaking threat activity and frequently linked to the Silver Fox intrusion set. It has been observed since at least 2023 in both espionage-leaning and financially motivated operations, including campaigns targeting industrial manufacturing, corporate finance, taxpayers, and organizations across Asia and other regions. Reported victimology includes Chinese- and Japanese-speaking users, Russian organizations, and Indian tax-season targets, with activity spanning sectors such as manufacturing, consulting, trade, transport, government, healthcare, education, and financial services.
ValleyRAT is typically deployed through multi-stage intrusion chains rather than as a simple standalone payload. Observed delivery patterns include phishing emails with tax, invoice, personnel, or salary-themed lures; attacker-controlled landing pages; malicious archives; fake software installers; and abuse of legitimate applications for DLL sideloading. Campaigns have used trusted software as sideloading hosts, including VLC-themed bundles and other signed or legitimate executables, and some operations used malicious VHDX containers or trojanized installers masquerading as common software. ValleyRAT has also been distributed by third-party malware-enablement services such as Cruciferra.
The malware provides full remote control of compromised Windows systems. Reported capabilities include command execution, file management and transfer, system reconnaissance, download of additional encrypted modules or plugins, and long-term backdoor access. Multiple analyses describe process injection and fileless in-memory execution, often by decrypting payloads directly in memory and injecting them into suspended system processes. ValleyRAT variants and related stages have also been observed using dynamic API resolution, runtime string decryption, API hashing, anti-analysis checks based on memory size, processor count, sleep timing, and virtualization heuristics, as well as junk code and other reverse-engineering impediments.
Persistence is a recurring feature. Observed mechanisms include Windows registry autoruns, scheduled tasks, Windows services, watchdog or recovery scripts, and redundant relaunch logic designed to restore the malware if terminated. Some campaigns stored payloads or configuration in the registry before execution. Defense-evasion tradecraft reported around ValleyRAT and closely related Winos4.0 activity includes DLL sideloading, user-mode unhooking of ntdll, BYOVD-assisted termination of security products, AMSI bypass in associated loaders, and use of legitimate signed binaries to blend malicious execution into normal system activity.
Several reports describe ValleyRAT as modular. Second-stage and follow-on components have been documented performing reconnaissance, keylogging, shell execution, file upload and download, and deployment of additional backdoors. In some campaigns ValleyRAT acted as a delivery platform for further malware, including Python backdoors. Other reporting describes broader Winos4.0 ecosystem functionality such as screenshot capture, clipboard monitoring, and theft-oriented extensions, though not every capability is confirmed for every ValleyRAT sample.
Attribution remains campaign-dependent. ValleyRAT use alone is not sufficient to attribute an intrusion, but repeated overlaps in tooling, infrastructure patterns, execution flow, and victimology have led multiple researchers to associate significant ValleyRAT activity with Silver Fox and other Chinese-speaking operators. Public reporting also notes architectural and ecosystem overlap with Gh0stRAT-derived tooling, with some analyses describing Winos4.0 as a modular framework rebuilt from Gh0stRAT.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2023-52271 documents how an affected version of wsftprm.sys can be abused to terminate protected processes.
"It's worth noting that the NSecKrnl driver is susceptible to a known security flaw (CVE-2025-68947, CVSS score: 5.7) that could be exploited to terminate arbitrary processes."
12 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The campaign targeted a Japanese organization in the industrial manufacturing sector and ultimately deployed ValleyRAT for remote access.
Howler Cell identified a new 32-bit malicious installer disguised as a Google Chrome installer, which kickstarts a multi-stage delivery chain, ultimately deploying the ValleyRAT remote access trojan.
The results of the IDS-rules detection are compatible with Win32/ProcessKiller, Winos4.0 and Backdoor SilverFox which both have the alias ValleyRAT.
The threat actor also attempted to use a downloader built using the advanced malicious framework Winos4.0. The downloader, placed under drivers\etc masquerading as hosts.exe, attempted to connect to the IP address 154.201.68[.]57. After a successful connection, it downloads the payload and saves it into the registry key d33f351a4aeea5e608853d1a56661059. It then executes the payload.
Finally, this Proofpoint cybercrime analysis notes that the threat group continues to abuse the open-source Winos4.0 framework. In early 2026, researchers spotted a heavily modified variant featuring a massive codebase expansion.
Analysts found infrastructure overlaps between this campaign and previous npm typosquatting attacks that distributed ValleyRAT (also known as Winos 4.0).
35 distinct techniques documented for this family, organized by ATT&CK tactic.
2. Initial Access - Drive-by Compromise (T1189) + Malicious Link (T1204.001) Пользователь находит отравленный результат в поиске и переходит по ссылке.
To maintain execution across system reboots and user logons, the malware creates a Windows Scheduled Task that launches the second-stage loader automatically.
During execution, the script uses the PowerShell Add-MpPreference cmdlet to create a Microsoft Defender exclusion for the target folder where additional malicious files are staged.
After extracting additional components, man.exe launches bypass.exe using the WdcRunTaskAsInteractiveUser method. This API is resolved dynamically at runtime using GetProcAddress.
The attack chain employs social engineering and counterfeit domains to trick users into downloading malicious ZIP archives.
2. Initial Access - Drive-by Compromise (T1189) + Malicious Link (T1204.001) Пользователь находит отравленный результат в поиске и переходит по ссылке.
After launching the second-stage executable, the malware starts cmd.exe and executes the watchdog script. The script repeatedly uses native Windows utilities... If the process is no longer present, the script relaunches the executable
To maintain execution across system reboots and user logons, the malware creates a Windows Scheduled Task that launches the second-stage loader automatically.
After launching the second-stage executable, the malware starts cmd.exe and executes the watchdog script. The script repeatedly uses native Windows utilities... If the process is no longer present, the script relaunches the executable
To maintain execution across system reboots and user logons, the malware creates a Windows Scheduled Task that launches the second-stage loader automatically.
The malware downloads shellcode and executes it through thread-context hijacking.
It then allocates memory inside the suspended process with VirtualAllocEx() , writes the downloaded shellcode with WriteProcessMemory() , and retrieves the primary thread’s execution context using GetThreadContext() ... commits the updated context with SetThreadContext(). Finally, it invokes ResumeThread()
The malware integrates Bring Your Own Vulnerable Driver (BYOVD)... The loader embeds three vulnerable drivers in a reusable BYOVD framework designed to terminate security processes from kernel mode.
The embedded resources are protected with RC4 and remain encrypted until the execution framework requires them.
These include a legitimately signed Google Chrome installer and several archived and encrypted components used to carry out malicious activity in the background... Password-protected 7-Zip archive... RC4-encrypted PE file.
the group's operations may appear unsophisticated due to the use of SEO poisoning and counterfeit software installers... employing fake software installers
4. Defense Evasion - Match Legitimate Name or Location (T1036.005) Вредоносные домены и файлы маскируются под легитимные. Кампания EclecticIQ использует дополнительный приём: параллельная установка настоящего npm-пакета маскирует вредоносную активность.
The malware downloads shellcode and executes it through thread-context hijacking.
It then allocates memory inside the suspended process with VirtualAllocEx() , writes the downloaded shellcode with WriteProcessMemory() , and retrieves the primary thread’s execution context using GetThreadContext() ... commits the updated context with SetThreadContext(). Finally, it invokes ResumeThread()
After completing the attack chain, man.exe creates a batch file named delete_self.bat to remove all files it had dropped during execution.
The purpose of this executable is to read an encrypted file named Windows.log and decrypt it using a custom RC4 key... After decryption, a DLL ... is loaded into memory.
В других кампаниях Silver Fox... ValleyRAT использовал Signed Binary Proxy Execution через rundll32.exe (T1218.011, Defense Evasion) - загрузка вредоносной DLL через легитимный системный процесс.
Rundll32 также может использоваться для сокрытия данных в NTFS-атрибутах (T1564.004).
613 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
155 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan distributed via Cruciferra.
Final-stage remote access malware delivered by the SilverFox campaign. It is executed via shellcode injected into a suspended svchost.exe process, uses registry-stored payload/configuration data, and provides command-and-control communication, task execution, and post-compromise remote access capabilities.
A remote access trojan observed being dropped by Cruciferra.
Троян удалённого доступа, обеспечивающий полный удалённый контроль, выполнение произвольного shellcode, повышение привилегий, персистентность, C2-коммуникацию и доставку дополнительной малвари, включая ABCDoor.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.