Description

Cybersecurity researchers have identified the updated version of the malware ValleyRAT, now featuring enhanced capabilities such as the capturing screenshots, process filtering, forced shutdown, and clearing Windows event logs. This update was uncovered by Zscaler ThreatLabz researchers Muhammed Irfan V A and Manisha Ramcharan Prajapati. ValleyRAT, previously documented by QiAnXin and Proofpoint in 2023, was linked to phishing campaigns targeting Chinese-speaking users and Japanese organizations. These campaigns also distributed malware families like Purple Fox and a variant of Gh0st RAT known as Sainbox RAT (FatalRAT). TCybersecurity researchers have identified an updated version of the ValleyRAT malware being distributed in a new campaign. According to Zscaler ThreatLabz researchers Muhammed Irfan V A and Manisha Ramcharan Prajapati, the latest ValleyRAT variant introduces new commands, including screenshot capture, process filtering, forced shutdown, and clearing Windows event logs. Initially documented by QiAnXin and Proofpoint in 2023, ValleyRAT is linked to a phishing campaign targeting Chinese-speaking users and Japanese organizations, distributing malware like Purple Fox and Sainbox RAT (aka FatalRAT). The malware is believed to be operated by a China-based threat actor and is capable of harvesting sensitive information and dropping additional payloads on compromised systems. The infection begins with a downloader using an HTTP File Server (HFS) to fetch and decode a file named "NTUSER.DXM," extracting a DLL that downloads "client.exe." This DLL detects and terminates anti-malware solutions from Qihoo 360 and WinRAR, retrieving three additional files—"WINWORD2013.EXE," "wwlib.dll," and "xig.ppt"—from the HFS server. The malware uses "WINWORD2013.EXE," a legitimate Microsoft Word executable, to sideload "wwlib.dll," which then establishes persistence and loads "xig.ppt" into memory. The decrypted "xig.ppt" then decrypts and injects shellcode into svchost.exe, creating a suspended process and allocating memory for shellcode. The shellcode configures the malware to contact a command-and-control (C2) server and download the ValleyRAT payload as a DLL file. This multi-stage infection process and DLL sideloading help evade detection by EDRs and anti-virus applications. Concurrently, Fortinet FortiGuard Labs reported a phishing campaign targeting Spanish-speaking users with an updated Agent Tesla keylogger, exploiting Microsoft Excel Add-Ins (XLA) vulnerabilities to load a PowerShell script, launching a loader to retrieve Agent Tesla. This variant collects credentials, email contacts, and device information, particularly targeting Thunderbird users.