Loading malware…
ValleyRAT, also known as Winos 4.0, is a Windows remote access trojan associated in multiple campaigns with Chinese-speaking threat actors, especially the Silver Fox cybercrime ecosystem, while also appearing in activity linked to GoldenEyeDog subgroups and as a payload delivered by third-party malware services and loaders. Public reporting indicates the family has been active since at least 2023 and that builder or source components have circulated publicly, so malware-family identification alone is not sufficient for actor attribution.
ValleyRAT is used to establish persistent remote access and full control over compromised systems. Reported capabilities include command execution, file management and transfer, system reconnaissance, screenshot capture, keylogging, plugin or module delivery, payload staging, and broader post-compromise tasking. Some observed variants or stages also support process injection, watchdog-based recovery, scheduled-task or registry-based persistence, and encrypted or in-memory loading of additional components. Reporting also describes use of anti-analysis and defense-evasion measures such as runtime string decryption, API hashing or dynamic API resolution, junk code, sandbox checks, NTDLL unhooking, and fileless execution. In several campaigns, ValleyRAT was delivered through multi-stage chains that injected the final payload into suspended Windows processes.
Observed delivery methods are diverse. Campaigns have used phishing lures themed around invoices, tax notices, personnel transfers, and salary changes; ZIP or VHDX containers; trojanized or fake software installers; DLL sideloading with legitimate signed applications; watering-hole activity; and abuse of software distribution or update channels. ValleyRAT has also been delivered by intermediary tooling including DONUTLoader, UUIDLoader, Cruciferra, customized Rust loaders, and malicious installers masquerading as common software. Some Silver Fox-linked intrusions combined ValleyRAT deployment with bring-your-own-vulnerable-driver techniques to disable security controls before or during execution.
Targeting has included organizations and individuals in East and Southeast Asia, India, Japan, and Russia, with reported victims in industrial manufacturing, gambling, finance-related functions, consulting, trade, transport, and other sectors. Campaigns have been described as both financially motivated and espionage-oriented depending on the operator and intrusion set. ValleyRAT remains notable for its modularity, frequent use in layered intrusion chains, and repeated pairing with stealth and persistence mechanisms designed to preserve long-term access on Windows hosts.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2023-52271 documents how an affected version of wsftprm.sys can be abused to terminate protected processes.
"It's worth noting that the NSecKrnl driver is susceptible to a known security flaw (CVE-2025-68947, CVSS score: 5.7) that could be exploited to terminate arbitrary processes."
14 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
CuboidalCanine (Expel-TA-0003): GoldenEyeDog’s ValleyRAT favoring subgroup... a faction of GoldenEyeDog stopped using their custom Gh0st RAT and moved to using ValleyRAT.
CuboidalCanine (Expel-TA-0003): GoldenEyeDog’s ValleyRAT favoring subgroup... a faction of GoldenEyeDog stopped using their custom Gh0st RAT and moved to using ValleyRAT.
The ultimate goal of these attacks is to deploy ValleyRAT, also known as Winos 4.0, for persistent remote access.
Howler Cell identified a new 32-bit malicious installer disguised as a Google Chrome installer, which kickstarts a multi-stage delivery chain, ultimately deploying the ValleyRAT remote access trojan.
The results of the IDS-rules detection are compatible with Win32/ProcessKiller, Winos4.0 and Backdoor SilverFox which both have the alias ValleyRAT.
The threat actor also attempted to use a downloader built using the advanced malicious framework Winos4.0. The downloader, placed under drivers\etc masquerading as hosts.exe, attempted to connect to the IP address 154.201.68[.]57. After a successful connection, it downloads the payload and saves it into the registry key d33f351a4aeea5e608853d1a56661059. It then executes the payload.
37 distinct techniques documented for this family, organized by ATT&CK tactic.
In contrast to CylindricalCanine, CuboidalCanine targets the gambling industry, and still uses watering hole sites to distribute the malware.
The DLL loader... is also responsible for unleashing a watchdog batch script that ensures persistence by means of a scheduled task...
During execution, the script uses the PowerShell Add-MpPreference cmdlet to create a Microsoft Defender exclusion for the target folder where additional malicious files are staged.
After extracting additional components, man.exe launches bypass.exe using the WdcRunTaskAsInteractiveUser method. This API is resolved dynamically at runtime using GetProcAddress.
If the first payload is extracted from the sample, we find a shellcode, followed by a SafeRAT binary. The shellcode used to load the binary is DONUT.
The attack chain employs social engineering and counterfeit domains to trick users into downloading malicious ZIP archives.
2. Initial Access - Drive-by Compromise (T1189) + Malicious Link (T1204.001) Пользователь находит отравленный результат в поиске и переходит по ссылке.
After launching the second-stage executable, the malware starts cmd.exe and executes the watchdog script. The script repeatedly uses native Windows utilities... If the process is no longer present, the script relaunches the executable
After launching the second-stage executable, the malware starts cmd.exe and executes the watchdog script. The script repeatedly uses native Windows utilities... If the process is no longer present, the script relaunches the executable
The DLL loader... is also responsible for unleashing a watchdog batch script that ensures persistence by means of a scheduled task...
...fetch shellcode that's injected into a new "svchost.exe" process using a technique called thread-context hijacking.
...fetch shellcode that's injected into a new "svchost.exe" process using a technique called thread-context hijacking.
The Chinese cybercrime group known as Silver Fox has been observed using new drivers as part of bring your own vulnerable driver (BYOVD) attacks... not before leveraging the BYOVD technique to obtain kernel access and impair security controls on the compromised host to evade detection.
These drivers, embedded within a malicious DLL, form a modular BYOVD framework for defense evasion.
The embedded resources are protected with RC4 and remain encrypted until the execution framework requires them.
the group's operations may appear unsophisticated due to the use of SEO poisoning and counterfeit software installers... employing fake software installers
4. Defense Evasion - Match Legitimate Name or Location (T1036.005) Вредоносные домены и файлы маскируются под легитимные. Кампания EclecticIQ использует дополнительный приём: параллельная установка настоящего npm-пакета маскирует вредоносную активность.
...fetch shellcode that's injected into a new "svchost.exe" process using a technique called thread-context hijacking.
...fetch shellcode that's injected into a new "svchost.exe" process using a technique called thread-context hijacking.
On top of that, the malware uses NTDLL unhooking to remove user-mode inline hooks placed by endpoint security software to keep tabs on native Windows API activity.
The purpose of this executable is to read an encrypted file named Windows.log and decrypt it using a custom RC4 key... After decryption, a DLL ... is loaded into memory.
В других кампаниях Silver Fox... ValleyRAT использовал Signed Binary Proxy Execution через rundll32.exe (T1218.011, Defense Evasion) - загрузка вредоносной DLL через легитимный системный процесс.
The malware integrates Bring Your Own Vulnerable Driver (BYOVD), DLL side-loading, NTDLL unhooking, process injection, registry-based payload storage, and two independent recovery mechanisms...
...communicates with an external server ("43.128.26[.]132") to fetch shellcode... The resulting final-stage implant is ValleyRAT... including command-and-control (C2) communication...
After establishing communication with its command-and-control server at: 43[.]128[.]26[.]132 the malware downloads shellcode
657 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
159 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan used by the CuboidalCanine subgroup of GoldenEyeDog, distributed via watering hole sites and commonly signed with abused code-signing certificates to bypass Windows SmartScreen.
A remote access trojan used to establish persistent remote access on victim systems. In this campaign it is delivered via a phishing-initiated DLL side-loading chain and supported by BYOVD-based defense evasion, NTDLL unhooking, and a dual watchdog persistence design.
A final-stage remote access trojan used for persistent remote access. The content says it is a variant of Gh0st RAT and provides command-and-control communication, task execution, and additional post-compromise capabilities, while being supported by BYOVD, DLL sideloading, NTDLL unhooking, process injection, registry-based payload storage, and dual recovery mechanisms for resilience.
Previously documented RAT malware linked in the article to the same loader ecosystem as SafeRat. The content states SafeRat development is strongly inspired by ValleyRat, and that both DONUTLoader and UUIDLoader have been used to load ValleyRat.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.