China-Linked ValleyRAT Malware Resurfaces with Advanced Data Theft Tactics

Cybersecurity researchers have uncovered an up to date model of malware identified as ValleyRAT that’s being dispersed as portion of a new marketing campaign.

“In the latest variation, ValleyRAT released new instructions, these kinds of as capturing screenshots, procedure filtering, forced shutdown, and clearing Windows celebration logs,” Zscaler ThreatLabz researchers Muhammed Irfan V A and Manisha Ramcharan Prajapati claimed.

ValleyRAT was previously documented by QiAnXin and Proofpoint in 2023 in relationship with a phishing marketing campaign targeting Chinese-talking consumers and Japanese corporations that distributed several malware family members these types of as Purple Fox and a variant of the Gh0st RAT trojan regarded as Sainbox RAT (aka FatalRAT).

The malware has been assessed to be the operate of a China-centered menace actor, boasting of capabilities to harvest sensitive details and drop additional payloads on to compromised hosts.

The starting place is a downloader that makes use of an HTTP File Server (HFS) to fetch a file named “NTUSER.DXM” which is decoded to extract a DLL file liable for downloading “client.exe” from the exact server.

The decrypted DLL is also designed to detect and terminate anti-malware solutions from Qihoo 360 and WinRAR in an effort and hard work to evade investigation, soon after which the downloader proceeds to retrieve three extra documents – “WINWORD2013.EXE,” “wwlib.dll,” and “xig.ppt” – from the HFS server.

Subsequent, the malware launches “WINWORD2013.EXE,” a legitimate executable connected with Microsoft Word, employing it to sideload “wwlib.dll” that, in turn, establishes persistence on the procedure and hundreds “xig.ppt” into memory.

“From in this article, the decrypted ‘xig.ppt’ proceeds the execution process as a mechanism to decrypt and inject shellcode into svchost.exe,” the scientists explained. “The malware results in svchost.exe as a suspended process, allocates memory in just the procedure, and writes shellcode there.”

The shellcode, for its section, is made up of necessary configuration to get hold of a command-and-management (C2) server and down load the ValleyRAT payload in the sort of a DLL file.

“ValleyRAT makes use of a convoluted multi-phase procedure to infect a method with the ultimate payload that performs the greater part of the malicious operations,” the researchers explained. “This staged method combined with DLL side-loading are likely developed to greater evade host-based mostly security answers these kinds of as EDRs and anti-virus programs.”

The development will come as the Fortinet FortiGuard Labs uncovered a phishing campaign that targets Spanish-speaking persons with an up-to-date model of a keylogger and details stealer identified as Agent Tesla.

The attack chain normally takes benefit of Microsoft Excel Insert-Ins (XLA) file attachments that exploit recognised security flaws (CVE-2017-0199 and CVE-2017-11882) to result in the execution of JavaScript code that masses a PowerShell script, which is engineered to start a loader in buy to retrieve Agent Tesla from a remote server.

“This variant collects credentials and email contacts from the victim’s device, the software from which it collects the details, and the fundamental information of the victim’s device,” security researcher Xiaopeng Zhang claimed. “Agent Tesla can also gather the victim’s email contacts if they use Thunderbird as their email consumer.”

Located this report exciting? Observe us on Twitter  and LinkedIn to read through a lot more special content material we post.

Some parts of this article are sourced from:
thehackernews.com