SYMBOLCOMMON_NAMEaka. SYNONYMS
win.valley_rat (Back to overview)

ValleyRAT

aka: Winos
VTCollection    

There is no description at this point.

References
2026-09-14 ⋅ Github (Yavuzhanzgen) ⋅ Yavuzhan Özgen
ValleyRAT Technical Analysis Report
ValleyRAT
2026-06-25 ⋅ Netresec ⋅ Erik Hjelmvik
Ping32 RMM and ValleyRAT
ValleyRAT
2026-05-20 ⋅ K7 Security ⋅ Srinivasan E
Fake Microsoft Teams download sites are being used to deliver ValleyRAT via DLL sideloading
ValleyRAT
2026-01-13 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update July to December 2025
Coper FluBot Joker Aisuru Mirai AsyncRAT BianLian Cobalt Strike DCRat Havoc Latrodectus PureLogs Stealer Quasar RAT Remcos Rhadamanthys Sliver ValleyRAT Venom RAT Vidar XWorm
2026-01-11 ⋅ Medium APOPHIS ⋅ Michelle Khalil
ValleyRAT_S2 Chinese campaign
ValleyRAT
2025-12-24 ⋅ Cloudsek ⋅ Koushik Pal, somedieyoungZZ
Silver Fox Targeting India Using Tax Themed Phishing Lures
ValleyRAT Winos
2025-12-10 ⋅ Check Point Research ⋅ Check Point Research, Jiří Vinopal
Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits
ValleyRAT
2025-10-22 ⋅ Cyderes ⋅ Rahul Ramesh
Chrome Installer Impersonation Campaign Targets China-Based Victims with ValleyRAT Trojan
BlindEDR ValleyRAT
2025-09-24 ⋅ Netresec ⋅ Erik Hjelmvik
Gh0stKCP Protocol
PseudoManuscrypt ValleyRAT
2025-09-07 ⋅ Hexastrike Cybersecurity ⋅ Maurice Fielenbach
ValleyRAT Exploiting BYOVD to Kill Endpoint Security
ValleyRAT
2025-08-28 ⋅ Checkpoint ⋅ Checkpoint Research
Chasing the Silver Fox: Cat & Mouse in Kernel Shadows
ValleyRAT
2025-07-14 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update January to June 2025
Coper FluBot Hook Joker Mirai AsyncRAT BianLian BumbleBee Chaos Cobalt Strike DanaBot DCRat Havoc Latrodectus NjRAT Quasar RAT RedLine Stealer Remcos Rhadamanthys Sliver ValleyRAT WarmCookie XWorm
2025-04-07 ⋅ ANY.RUN ⋅ ANY.RUN
ValleyRAT
ValleyRAT
2025-02-27 ⋅ Fortinet ⋅ Pei Han Liao
Winos 4.0 Spreads via Impersonation of Official Email to Target Users in Taiwan
ValleyRAT Winos
2025-02-20 ⋅ Silent Push ⋅ Silent Push
Tweet on Tracking ValleyRAT Domains with ICP Licenses
ValleyRAT
2025-01-29 ⋅ Palo Alto Networks Unit 42 ⋅ Lior Rochberger, Yoav Zemah
CL-STA-0048: An Espionage Operation Against High-Value Targets in South Asia
Cobalt Strike MimiKatz PlugX ValleyRAT Winos CL-STA-0048
2024-12-18 ⋅ eSentire ⋅ eSentire Threat Response Unit (TRU)
Winos4.0 “Online Module” Staging Component Used in CleverSoar Campaign
ValleyRAT
2024-11-27 ⋅ Rapid7 ⋅ Natalie Zargarov
New “CleverSoar” Installer Targets Chinese and Vietnamese Users
ValleyRAT
2024-06-19 ⋅ Trend Micro ⋅ Ahmed Mohamed Ibrahim, Aliakbar Zahravi, Peter Girnus
Behind the Great Wall: Void Arachne Targets Chinese-Speaking Users With the Winos 4.0 C&C Framework
ValleyRAT Void Arachne
2024-06-10 ⋅ Zscaler ⋅ Manisha Ramcharan Prajapati, Muhammed Irfan V A
Technical Analysis of the Latest Variant of ValleyRAT
ValleyRAT
2023-09-20 ⋅ Proofpoint ⋅ Proofpoint Threat Research Team
Chinese Malware Appears in Earnest Across Cybercrime Threat Landscape
FatalRat PurpleFox ValleyRAT
2023-02-18 ⋅ secrss ⋅ Qianxin Virus Response Center
Don’t follow in the footsteps of the 4 billion data leak incident! Early warning for attacks in the financial and securities industries
ValleyRAT
Yara Rules
[TLP:WHITE] win_valley_rat_auto (20260917 | Detects win.valley_rat.)
rule win_valley_rat_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.valley_rat."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.valley_rat"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 005c7e46 00847e46008a46 0323 d188470383ee }
            // n = 4, score = 100
            //   005c7e46             | add                 byte ptr [esi + edi*2 + 0x46], bl
            //   00847e46008a46       | add                 byte ptr [esi + edi*2 + 0x468a0046], al
            //   0323                 | add                 esp, dword ptr [ebx]
            //   d188470383ee         | ror                 dword ptr [eax - 0x117cfcb9], 1

        $sequence_1 = { c7850cf8ffffdfbfe764 c78510f8ffffebb710d3 c78514f8ffffbb16df9a c78518f8ffffa3cb642f }
            // n = 4, score = 100
            //   c7850cf8ffffdfbfe764     | mov    dword ptr [ebp - 0x7f4], 0x64e7bfdf
            //   c78510f8ffffebb710d3     | mov    dword ptr [ebp - 0x7f0], 0xd310b7eb
            //   c78514f8ffffbb16df9a     | mov    dword ptr [ebp - 0x7ec], 0x9adf16bb
            //   c78518f8ffffa3cb642f     | mov    dword ptr [ebp - 0x7e8], 0x2f64cba3

        $sequence_2 = { 00bcaf4500c5af 45 00f8 af }
            // n = 4, score = 100
            //   00bcaf4500c5af       | add                 byte ptr [edi + ebp*4 - 0x503affbb], bh
            //   45                   | inc                 ebp
            //   00f8                 | add                 al, bh
            //   af                   | scasd               eax, dword ptr es:[edi]

        $sequence_3 = { 0101 0101 0201 0102 }
            // n = 4, score = 100
            //   0101                 | add                 dword ptr [ecx], eax
            //   0101                 | add                 dword ptr [ecx], eax
            //   0201                 | add                 al, byte ptr [ecx]
            //   0102                 | add                 dword ptr [edx], eax

        $sequence_4 = { c3 8b04c5b46c0110 5d c3 8bff 55 8bec }
            // n = 7, score = 100
            //   c3                   | ret                 
            //   8b04c5b46c0110       | mov                 eax, dword ptr [eax*8 + 0x10016cb4]
            //   5d                   | pop                 ebp
            //   c3                   | ret                 
            //   8bff                 | mov                 edi, edi
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp

        $sequence_5 = { 0101 33c0 8be5 5d }
            // n = 4, score = 100
            //   0101                 | add                 dword ptr [ecx], eax
            //   33c0                 | xor                 eax, eax
            //   8be5                 | mov                 esp, ebp
            //   5d                   | pop                 ebp

        $sequence_6 = { 0101 0101 0101 0101 0101 0505050505 }
            // n = 6, score = 100
            //   0101                 | add                 dword ptr [ecx], eax
            //   0101                 | add                 dword ptr [ecx], eax
            //   0101                 | add                 dword ptr [ecx], eax
            //   0101                 | add                 dword ptr [ecx], eax
            //   0101                 | add                 dword ptr [ecx], eax
            //   0505050505           | add                 eax, 0x5050505

        $sequence_7 = { 0001 0101 0102 0101 }
            // n = 4, score = 100
            //   0001                 | add                 byte ptr [ecx], al
            //   0101                 | add                 dword ptr [ecx], eax
            //   0102                 | add                 dword ptr [edx], eax
            //   0101                 | add                 dword ptr [ecx], eax

        $sequence_8 = { 0f8520020000 8d45f8 50 6819000200 }
            // n = 4, score = 100
            //   0f8520020000         | jne                 0x226
            //   8d45f8               | lea                 eax, [ebp - 8]
            //   50                   | push                eax
            //   6819000200           | push                0x20019

        $sequence_9 = { 0101 33c0 5e 5b }
            // n = 4, score = 100
            //   0101                 | add                 dword ptr [ecx], eax
            //   33c0                 | xor                 eax, eax
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx

        $sequence_10 = { 0101 0505050505 0505050505 0505050505 0505050505 0505050505 }
            // n = 6, score = 100
            //   0101                 | add                 dword ptr [ecx], eax
            //   0505050505           | add                 eax, 0x5050505
            //   0505050505           | add                 eax, 0x5050505
            //   0505050505           | add                 eax, 0x5050505
            //   0505050505           | add                 eax, 0x5050505
            //   0505050505           | add                 eax, 0x5050505

        $sequence_11 = { c785ccfefffff79be79b c785d0feffffab9ba19b c785d4fefffff39bf99b c785d8feffffe79bab9b c785dcfeffffa19beb9b c785e0fefffff19be79b c785e4feffffab9baa9b }
            // n = 7, score = 100
            //   c785ccfefffff79be79b     | mov    dword ptr [ebp - 0x134], 0x9be79bf7
            //   c785d0feffffab9ba19b     | mov    dword ptr [ebp - 0x130], 0x9ba19bab
            //   c785d4fefffff39bf99b     | mov    dword ptr [ebp - 0x12c], 0x9bf99bf3
            //   c785d8feffffe79bab9b     | mov    dword ptr [ebp - 0x128], 0x9bab9be7
            //   c785dcfeffffa19beb9b     | mov    dword ptr [ebp - 0x124], 0x9beb9ba1
            //   c785e0fefffff19be79b     | mov    dword ptr [ebp - 0x120], 0x9be79bf1
            //   c785e4feffffab9baa9b     | mov    dword ptr [ebp - 0x11c], 0x9baa9bab

        $sequence_12 = { 6a00 8d8dfcfeffff 51 ff15???????? 85c0 750e 8b4dfc }
            // n = 7, score = 100
            //   6a00                 | push                0
            //   8d8dfcfeffff         | lea                 ecx, [ebp - 0x104]
            //   51                   | push                ecx
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   750e                 | jne                 0x10
            //   8b4dfc               | mov                 ecx, dword ptr [ebp - 4]

        $sequence_13 = { 030cb5c0f90110 eb02 8bca f641247f 759b }
            // n = 5, score = 100
            //   030cb5c0f90110       | add                 ecx, dword ptr [esi*4 + 0x1001f9c0]
            //   eb02                 | jmp                 4
            //   8bca                 | mov                 ecx, edx
            //   f641247f             | test                byte ptr [ecx + 0x24], 0x7f
            //   759b                 | jne                 0xffffff9d

        $sequence_14 = { 381d???????? a3???????? 0f94c1 880d???????? }
            // n = 4, score = 100
            //   381d????????         |                     
            //   a3????????           |                     
            //   0f94c1               | sete                cl
            //   880d????????         |                     

        $sequence_15 = { c78564f6ffffef12c7bf c78568f6ffffe310db97 c7856cf6ffff10db8fcd c78570f6ffffcc70d994 c78574f6ffff2cd3bf10 c78578f6ffffcbb34a72 c7857cf6ffffa864a050 }
            // n = 7, score = 100
            //   c78564f6ffffef12c7bf     | mov    dword ptr [ebp - 0x99c], 0xbfc712ef
            //   c78568f6ffffe310db97     | mov    dword ptr [ebp - 0x998], 0x97db10e3
            //   c7856cf6ffff10db8fcd     | mov    dword ptr [ebp - 0x994], 0xcd8fdb10
            //   c78570f6ffffcc70d994     | mov    dword ptr [ebp - 0x990], 0x94d970cc
            //   c78574f6ffff2cd3bf10     | mov    dword ptr [ebp - 0x98c], 0x10bfd32c
            //   c78578f6ffffcbb34a72     | mov    dword ptr [ebp - 0x988], 0x724ab3cb
            //   c7857cf6ffffa864a050     | mov    dword ptr [ebp - 0x984], 0x50a064a8

    condition:
        7 of them and filesize < 2256896
}
Download all Yara Rules