Valley RAT

Valley RAT is a modular remote access trojan used in phishing-led intrusion campaigns attributed in the provided content to the Chinese threat actor Silver Fox, targeting Indian organizations with Income Tax-themed lures. The described infection chain begins with phishing emails impersonating the Indian Income Tax Department and PDF attachments that lead victims to a malicious site such as ggwk[.]cc, which delivers a ZIP or executable disguised as a tax-related file (including names such as "tax affairs.exe" or "tax_affairs.exe"). The attack uses DLL hijacking by dropping the legitimate Xunlei executable Thunder.exe alongside a malicious libexpat.dll. The malicious DLL performs anti-analysis checks for sandboxes and security tools, disables Windows Update services, decrypts an encrypted payload from box.ini, and ultimately leads to Valley RAT execution. One described chain uses a Donut loader to inject the final payload into a hollowed explorer.exe process.

Once active, Valley RAT initializes a two-stage configuration subsystem, extracting 22 configuration parameters from embedded data and optionally replacing key command-and-control settings with updated configuration retrieved from the Windows registry. This allows operators to rotate C2 infrastructure without redeploying the malware. The malware then launches a payload thread implementing a three-tier C2 failover loop across primary, secondary, and tertiary servers, using HTTP, HTTPS, or raw TCP with configurable beacon intervals and initial delays. Upon successful connection it sends a "ready" beacon with command ID 4, and it can enable keylogging via configuration.

The malware is described as establishing persistent command and control and supporting command execution, keystroke capture, credential harvesting, file transfer, and deployment of additional modules. Its modular plugin architecture stores downloaded plugins in the registry under HKCU\Console\0\d33f351a4aeea5e608853d1a56661059, using a value name described as a consistent Valley RAT fingerprint and following an MD5-style naming convention observed across campaigns. Plugins may be received from C2 and persisted as REG_BINARY with executable memory allocation, or reloaded from the registry after validation against a hardcoded signature; each plugin includes a 0xC9 magic-byte guard to prevent double execution. Downloaded plugins are injected into tracerpt.exe via process hollowing after being patched with a 4768-byte configuration blob containing C2 addresses and feature flags.

High-confidence infrastructure and indicators mentioned in the content include primary shellcode C2 b[.]yuxuanow[.]top resolving to 103.20.195[.]147, additional rotating domains including itdd[.]club, gov-a[.]work, and xzghjec[.]com, the malicious DLL name libexpat.dll, encrypted payload box.ini, and registry persistence/storage at HKCU\Console\0\d33f351a4aeea5e608853d1a56661059. The content characterizes Valley RAT as a sophisticated, persistent, and customizable RAT used to maintain long-term access in targeted campaigns against Indian entities.