ValleyRAT: Advanced Stealth RAT Utilizing RC4, Donut Shellcode, and Kernel-Mode Rootkits
ValleyRAT is a modular Remote Access Trojan (RAT) leveraging a multi-stage infection chain to achieve deep system persistence and invisibility. Initial access is gained via deceptive software installers, followed by the deployment of position-independent shellcode generated by Donut and injected into rundll32.exe using Asynchronous Procedure Calls (APCs). The malware employs RC4 stream ciphers for C2 communication and configuration obfuscation. Most critically, it deploys a kernel-mode rootkit to operate beneath the visibility of user-mode security tools, enabling undetected data exfiltration. This threat is primarily associated with WinOS 4.0 campaigns targeting Taiwanese entities, indicating a sophisticated state-sponsored espionage operation.