TECHNICAL ANALYSIS OF THE LATEST VARIANT OF VALLEYRAT

Summary from the TLDR InfoSec newsletter

The ValleyRAT malware uses a multi-stage process involving DLL sideloading, process injection, and shellcode execution to establish connections with a command-and-control server for downloading further malicious payloads. The malware utilizes encryption, decryption, and hashing algorithms to dynamically load and execute embedded DLLs, collect system information, and carry out specific actions based on the victim host's configuration. ValleyRAT conducts device fingerprinting to gather detailed information about the infected system, such as IP address, system uptime, hardware details, and user privileges, aiding in its malicious activities.