THREAT OPS › Threat News › ValleyRAT masquerading as adware
ValleyRAT masquerading as adware
<p><img alt="" class="attachment-securelist-huge-promo size-securelist-huge-promo wp-post-image" height="400" src="https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2026/08/28184605/SL-valleyRAT-abuses-adware-featured-scaled-1-990x400.jpg" width="990" /></p><p>Attackers typically try to pass off malware as legitimate applications or as potentially unwanted programs that users delib
MITRE ATT&CK techniques
Indicators of compromise
- c24e99f9437feacaa63766a3cde3fe3dmd5
- 7ad1e3ef4e6d9d636c9e7e967733850emd5
- 96b4c1d0683dce22bd3223e1e40689c1md5
- 9b86d3ab6cef15c633933fbbeab39c0amd5
- edfdc30cbd85879776b8f735ea7de1f1md5
- 07ddbbe2c71c45577a7a4fbcdba0df91md5
- 48826d5ca845979d2e6ebd66dc1aae90md5
- 6c158c0f8e029342192d4f0d72e102b7md5
- 9a71d6a41cd258b9e89cdc5fc224de73md5
- 8a626d844943da3456b044f38deae3a2md5
- https://meeting.tencent.com/download/url
- https://qnwallpaper.keansoft.cn/url
- https://encyclopedia.kaspersky.com/glossary/dll-sideloading/url
- https://www.kaspersky.com/enterprise-security/security-awareness?icid=gl_sl_lnk-security-awareness_sm-team_df95e80a3921c34durl
- https://opentip.kaspersky.com/07ddbbe2c71c45577a7a4fbcdba0df91/?utm_source=sl&utm_medium=sl&utm_campaign=sl&icid=gl_sl_opentip-lnk_sm-team_69ac286c8b13b8c7url
- https://opentip.kaspersky.com/c24e99f9437feacaa63766a3cde3fe3d/?utm_source=sl&utm_medium=sl&utm_campaign=sl&icid=gl_sl_opentip-lnk_sm-team_7e0f4f63d22c73d4url
- https://opentip.kaspersky.com/8a626d844943da3456b044f38deae3a2/?utm_source=sl&utm_medium=sl&utm_campaign=sl&icid=gl_sl_opentip-lnk_sm-team_8d2ab9db1a993061url
- https://opentip.kaspersky.com/103.45.66.18/?utm_source=sl&utm_medium=sl&utm_campaign=sl&icid=gl_sl_opentip-lnk_sm-team_e2a4368ab7637cd6url
- https://opentip.kaspersky.com/192.253.225.173/?utm_source=sl&utm_medium=sl&utm_campaign=sl&icid=gl_sl_opentip-lnk_sm-team_546d8349f180734url
- 103.45.66.18ipv4
- 192.253.225.173ipv4
- media.kasperskycontenthub.comdomain
Original source: https://securelist.com/valleyrat-backdoor-adware/121175/