Loading malware…
ValleyRAT, also known as Winos4.0, is a multi-stage Windows remote access trojan associated in multiple investigations with the Silver Fox cybercrime ecosystem and broader Gh0stRAT-derived tooling. It has been active in the wild since at least 2023 and is used in campaigns targeting primarily Chinese-speaking users, as well as victims in Japan, India, and parts of Southeast Asia. Reported delivery chains include phishing emails, tax-themed social engineering, trojanized software installers, fake software downloads, SEO-poisoning-driven fake installers, and repeated abuse of DLL sideloading with legitimate signed applications such as media players and other trusted executables.
ValleyRAT is designed for long-term remote control of compromised Windows systems. Documented capabilities include command execution, file management and transfer, system reconnaissance, download of additional encrypted modules, and modular plugin-based expansion. Multiple analyses also describe process injection, in-memory payload decryption and execution, runtime string decryption, API hashing, dynamic API resolution, and anti-analysis checks based on memory size, processor count, sleep timing, virtualization artifacts, and junk-code padding. Persistence has been observed through Windows registry autoruns, scheduled tasks, watchdog logic, Windows services, and in some cases recovery mechanisms that relaunch components if terminated.
More advanced ValleyRAT activity shows a highly layered infection architecture. Observed chains have used encrypted archives, steganographic payload concealment in image files, Donut-generated shellcode, RC4-encrypted stages, thread execution hijacking, and DLL sideloading through legitimate binaries. Some campaigns also used privilege escalation and security-tool suppression, including UAC bypass, Microsoft Defender exclusions, and tooling intended to disable or evade endpoint security products. Several reports describe ValleyRAT variants or related stages using kernel-level components or rootkit functionality, named-pipe coordination between user-mode and kernel-mode components, and support for large command sets suitable for persistent post-compromise operations.
ValleyRAT has been linked to both espionage-oriented and financially motivated activity. Reported data-theft behaviors include keylogging, credential harvesting, theft of Telegram data, screenshot capture, and clipboard hijacking for cryptocurrency wallet substitution. Communications have been observed over conventional command-and-control channels as well as WebSocket, QUIC, and Gh0stKCP-related traffic in some variants. The malware’s modularity, frequent recompilation, evolving delivery chains, and reliance on trusted software for sideloading make it a flexible and evasive RAT family within the contemporary China-linked cybercrime landscape.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
"It's worth noting that the NSecKrnl driver is susceptible to a known security flaw (CVE-2025-68947, CVSS score: 5.7) that could be exploited to terminate arbitrary processes."
12 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Howler Cell identified a new 32-bit malicious installer disguised as a Google Chrome installer, which kickstarts a multi-stage delivery chain, ultimately deploying the ValleyRAT remote access trojan.
The malware, tracked as ValleyRAT, is deployed by a hacking group known as SilverFox, and it stands out for one reason: it refuses to stop at just one payload.
The results of the IDS-rules detection are compatible with Win32/ProcessKiller, Winos4.0 and Backdoor SilverFox which both have the alias ValleyRAT.
The threat actor also attempted to use a downloader built using the advanced malicious framework Winos4.0. The downloader, placed under drivers\etc masquerading as hosts.exe, attempted to connect to the IP address 154.201.68[.]57. After a successful connection, it downloads the payload and saves it into the registry key d33f351a4aeea5e608853d1a56661059. It then executes the payload.
Finally, this Proofpoint cybercrime analysis notes that the threat group continues to abuse the open-source Winos4.0 framework. In early 2026, researchers spotted a heavily modified variant featuring a massive codebase expansion.
Analysts found infrastructure overlaps between this campaign and previous npm typosquatting attacks that distributed ValleyRAT (also known as Winos 4.0).
32 distinct techniques documented for this family, organized by ATT&CK tactic.
During execution, the script uses the PowerShell Add-MpPreference cmdlet to create a Microsoft Defender exclusion for the target folder where additional malicious files are staged.
After extracting additional components, man.exe launches bypass.exe using the WdcRunTaskAsInteractiveUser method. This API is resolved dynamically at runtime using GetProcAddress.
The attack chain employs social engineering and counterfeit domains to trick users into downloading malicious ZIP archives.
2. Initial Access - Drive-by Compromise (T1189) + Malicious Link (T1204.001) Пользователь находит отравленный результат в поиске и переходит по ссылке.
3. Execution - Malicious File (T1204.002) / PowerShell (T1059.001) ... Запуск NSIS-инсталлятора с недействительным сертификатом - кампания ASEC (KakaoTalk) Загрузка архива с "юридическим шаблоном" - GootLoader
Finally, a kernel rootkit is installed, supporting more than 65 command codes and taking instructions from the RAT through named pipes... Additional plugins can be pushed to victims after infection, again delivered through named pipes
The content is then read from the registry and injected into a newly spawned tracerpt.exe process via the Thread Execution Hijacking technique.
the final one drops a kernel level rootkit that takes direct orders from the RAT itself... Finally, a kernel rootkit is installed
These include a legitimately signed Google Chrome installer and several archived and encrypted components used to carry out malicious activity in the background... Password-protected 7-Zip archive... RC4-encrypted PE file.
Once running, the malware disables logging tools and antivirus scanning before hiding its next payload inside the pixel data of ordinary looking PNG images. That image based hiding technique, known as steganography, repeats at multiple points in the chain.
the group's operations may appear unsophisticated due to the use of SEO poisoning and counterfeit software installers... employing fake software installers
4. Defense Evasion - Match Legitimate Name or Location (T1036.005) Вредоносные домены и файлы маскируются под легитимные. Кампания EclecticIQ использует дополнительный приём: параллельная установка настоящего npm-пакета маскирует вредоносную активность.
The content is then read from the registry and injected into a newly spawned tracerpt.exe process via the Thread Execution Hijacking technique.
After completing the attack chain, man.exe creates a batch file named delete_self.bat to remove all files it had dropped during execution.
The purpose of this executable is to read an encrypted file named Windows.log and decrypt it using a custom RC4 key... After decryption, a DLL ... is loaded into memory.
Once launched, it performs checks to avoid executing within analysis and sandboxed environments
It monitors the clipboard for cryptocurrency wallet addresses and swaps them with ones controlled by the attackers
581 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
152 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote access trojan observed being dropped by Cruciferra.
Winos 4.03
Backdoor/RAT delivered via fake KakaoTalk installers in an SEO-poisoning campaign; provides full remote control including screenshots, system information collection, file management, and arbitrary code execution via C2.
Remote access trojan delivered via a government-themed social engineering campaign using a multi-stage infection chain with malicious VHDX, DLL sideloading, encrypted in-memory payload execution, runtime string decryption, API hashing, process injection, registry persistence, and dynamic download of additional encrypted modules from its C2 server.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.