Check Point · Published 10 Dec
Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits
By shlomoo@checkpoint.com
Excerpt
Check Point Research (CPR) presents a full dissection of the widely used ValleyRAT backdoor, also known as Winos/Winos4.0, covering its modular architecture and plugin system.
By analyzing the publicly leaked builder and development structure (Visual Studio solutions and project files, without source code), we were able to accurately correlate artifacts and reverse engineer the functionality of all “main” plugins. The analysis reveals the advanced skills of the developers behind ValleyRAT, demonstrating deep knowledge of Windows ke…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Check Point on research.checkpoint.com.
Mentioned in the excerpt1
More from Check Point94
Check Point · Web page · Published 7 Mar
Pandas with a Soul: Chinese Espionage Attacks Against Southeast Asian Government Entities
In 2021, Check Point Research published a report on a previously undisclosed toolset used by Sharp Panda, a long-running Chinese cyber-espionage operation targeting Southeast Asian government entities. Since then, we have continued to track the use of these…
Check Point · Web page · Published 27 Mar
Rhadamanthys: The “Everything Bagel” Infostealer
Rhadamanthys is an advanced infostealer which debuted on the dark web in September of last year to a warm critical reception by cybercriminals. A maximalist approach to features: functionality is added for its own sake, never mind the effort required or…
Check Point · Web page · Published 12 Jan
Going Rogue- a Mastermind behind Android Malware Returns with a New RAT
Research by: Aviran Hazum, Alex Shamshur, Raman Ladutska, Ohad Mana, Israel Wernik Introduction Now more than ever, we rely on our smartphones to keep in touch with our work, our families and the world around us. There are over 3.5 billion smartphone users…
Check Point · Web page · Published 10 Apr
Threat Actors Migrating to the Cloud
Where do malware payloads come from? It’s a question with an apparently trivial answer. Usually these sit on dedicated servers owned by the campaign managers, and occasionally on a legitimate website that has been broken into and commandeered. But, as we were…
On the same topics
cocomelonc.github.io · Web page · Published 23 Jun
MacOS malware persistence 12: Folder Actions. Simple AppleScript and C example
Hello, cybersecurity enthusiasts and white hackers! Continuing the macOS malware persistence series. In previous parts we already looked at LaunchAgents , shell environment hijacking, dylib hijacking, Login Items, cron , PAM modules, re-opened applications,…
WIRED · Web page · Published 3 Apr
The Mystery of ‘Jia Tan,’ the XZ Backdoor Mastermind
The scourge of software supply chain attacks—an increasingly common hacking technique that hides malicious code in a widely used legitimate program—can take many forms. Hackers can penetrate an update server to seed out their malware, or even break into the…
BlueVoyant · Web page · Added 25 Oct
Lorem Ipsum Revisited: ClickFix Pivot & Rapid Brigantine
What Happened? BlueVoyant Security Operations Center (SOC) and Threat Fusion Cell (TFC) researchers have been tracking an active ClickFix campaign that manipulates users into believing their web browser requires a security update. If the user complies, the…
JFrog · Web page · Published 22 Jun
From PostCSS Masquerading to Windows RAT
The package name is not random. The legitimate postcss-selector-parser package is widely used across the JavaScript build ecosystem, with npm reporting more than 150M weekly downloads. postcss-minify-selector-parser is not a classic one-character typo.…