ValleyRAT Campaign Targets Windows via WeChat and DingTalk

A sophisticated Windows remote‑access trojan known as ValleyRAT has emerged as a high‑confidence indicator of targeted intrusions against Chinese‑language users and organisations. Its operation rests on a four‑component delivery chain—the downloader, loader, injector, and RAT payload—built to maintain stealth through in‑memory decryption and living‑off‑the‑land techniques.

ValleyRAT first appeared in early 2023 and uses MSBuild.exe as an execution host to disguise activity as legitimate system processes, while employing a geographical kill switch mechanism that checks for the presence of WeChat and DingTalk in the Windows registry and terminates if both entries are absent.

The malware also prevents multiple instances with a named mutex called “TEST” and pursues privilege elevation via multiple UAC bypass techniques, manipulating components such as CompMgmtLauncher.exe, Event Viewer, and Fodhelper.exe and abusing a misused ms-settings ProgID for persistence.

It dismantles defenses by targeting Chinese security products like Qihoo 360, Tencent QQ PC Manager, and Kingsoft, uses CPUID whitelisting to detect virtual environments, and implements robust anti‑analysis by referencing the Picus Threat Library’s ValleyRAT entries.

It also monitors for tools such as Wireshark, Fiddler, Malwarebytes, ApateDNS, and TaskExplorer, and establishes persistence through Run keys and a Startup folder entry, before contacting its C2 via a dynamic beacon after an Internet connectivity check to baidu[.]com.