BreakglassIntelligence
Back to reports
Malware

ValleyRAT (Win64/Valley.E) — Multi-Stage BYOVD RAT with Kernel Driver

PublishedMarch 13, 2026
RATc2exploitapt

Executive Summary

This sample is a ValleyRAT variant E (Win64/Valley.E) delivered as a 32-bit DLL loader masquerading as the SQLite3 library (SQL3.DLL). It implements a three-stage execution chain terminating in a sophisticated 64-bit RAT that:

  1. Disables Windows Defender's Vulnerable Driver Blocklist (VulnerableDriverBlocklistEnable = 0) across both SYSTEM\ControlSet001 and SYSTEM\CurrentControlSet registry hives.
  2. Drops and loads a kernel-mode driver (DiskDump Driver) via NtLoadDriver, granting kernel-level persistence and EDR evasion capabilities.
  3. Establishes C2 to 103.210.238.29 (Hong Kong, HK Kwaifong Group Limited), with the C2 address double-base64 encoded in the binary to evade signature detection.
  4. Performs geo-filtering via ip-api.com/json/ checking countryCode before activating.
  5. Achieves UAC bypass via computerdefaults.exe and achieves persistence via Windows Task Scheduler.

ValleyRAT (also tracked as "Silver Fox" activity) is associated with Chinese-speaking threat actors targeting financial, manufacturing, and technology sectors. Compile timestamps and Chinese-language debug strings confirm the operator speaks Simplified Chinese. The fake company name "Golden Club Corpration." (deliberate typo) is a known ValleyRAT campaign branding.

Detection: 30/76 engines on VirusTotal. ESET labels it Win64/Valley.E, Rising Trojan.Valley!8.1D169, Kaspersky UDS:Backdoor.Win32.Xkcp.

Sample Metadata

FieldValue
SHA2561144433760a0683413a85da271bc37ff9f296ac287e722825f27577b529b9d27
MD58e8319ef77aa12f2335b339abf0ddadb
SHA17e0e21949852a56e1179302ecef5898086aef80a
File TypePE32 DLL (32-bit, Intel 80386)
File Size1,015,296 bytes
First Seen2026-03-13 15:25:17 UTC
Compile Timestamp2026-03-13 00:01:27 UTC (same day as submission)
VT Detections30/76
Suggested Labeltrojan.convagent/hack
Tagsdll, RAT, ValleyRAT, executes-dropped-file, detect-debug-environment
Reporterabuse_ch

Static Analysis

Stage 1 — DLL Loader (SQL3.DLL)

Architecture: 32-bit PE DLL, 6 sections.

Masquerading: Version resource declares SQL3.DLL / SQL3 product with Copyright (C) 2026, and the DLL exports 200+ fake sqlite3 API symbols — all pointing to the same function address (0x3de0). This causes any host application that calls sqlite3 functions to actually execute the RAT's entry point. Additional fake exports include CreatePlugin, GetHandleVerifier, GetPluginEffects, HostMainLoop, RunDLL, and yangeshi (Chinese: "style" — an accidental threat actor artifact).

Section Entropy:

SectionVARaw SizeEntropy
.text0x10000x238006.58
.rdata0x250000xEE005.30
.data0x340000x12003.51
.fptable0x360000x2000.00
.rsrc0x370000xC1E007.82
.reloc0xF90000x22006.43

The .rsrc section (793,864 bytes, entropy 7.82) contains the entire encrypted payload chain.

Key Imports (Stage 1):

  • KERNEL32.dll: LoadResource, LockResource, CreateProcessW, GetTempPathW
  • ADVAPI32.dll: RegCreateKeyExW, RegSetValueExW
  • WS2_32.dll: WSAStartup, socket, connect, send, recv
  • ntdll.dll: NtQueryInformationProcess (anti-debug)
  • ole32.dll: CoCreateGuid, StringFromCLSID (bot UUID generation)
  • USER32.dll: ShowWindow

Embedded Payload: Resource type RDATA, ID 101, Language 1028 (Traditional Chinese locale), size 792,576 bytes, starts with MZ magic — this is Stage 2.

Fake Version Resource (resource 2, language 0):

  • CompanyName: Golden Club Corpration. (deliberate typo)
  • FileDescription: Installer
  • FileVersion: 12.8.17.13
  • InternalName: Setup.exe
  • OriginalFilename: Setup.exe
  • ProductName: Installer
  • Copyright: Copyright (C) 2025

Stage 2 — UPX-Packed Dropper (extracted from .rsrc)

Hashes:

  • SHA256: c9a152ce795cad9b667a64b66abe473ff89310486c00a0b83f420ddb3db2548a
  • MD5: 8fdfc384f8c423b2452adb819c989b97

Architecture: 64-bit PE (x86_64), compiled 2026-03-13 00:00:51 UTC. Packing: UPX 4.2.2 — UPX0/UPX1 sections. Unpacked to 1,032,704 bytes (from 792,576 compressed).

Post-Unpack Sections:

SectionVAEntropy
.text0x10006.45
.rdata0x260005.12
.data0x3E0003.26
.rsrc0x450007.61

The .rsrc section (625KB, entropy 7.61) contains Stage 3 and two AES-encrypted blobs.

Defender Binary Masquerade (double-base64 encoded):

The following strings are stored as double base64 (outer → inner → plaintext):

VFhCRVpXWmxibVJsY2tOdmNtVlRaWEoyYVdObExtVjRaUT09
  → TXBEZWZlbmRlckNvcmVTZXJ2aWNlLmV4ZQ==
  → MpDefenderCoreService.exe

VFhCRGJXUlNkVzR1WlhobA==
  → TXBDbWRSdW4uZXhl
  → MpCmdRun.exe

Stage 2 masquerades execution as legitimate Microsoft Defender binaries using this double-encoding, likely for DLL side-loading into Defender process space.

C2 IP (double-base64 encoded):

TVRBekxqSXhNQzR5TXpndU1qaz0=
  → MTAzLjIxMC4yMzguMjk=
  → 103.210.238.29

Key Stage 2 Capabilities:

  • IP geolocation via ip-api.com/json/ → extracts countryCode (geo-filtering)
  • Flushes DNS cache via DnsFlushResolverCache / 8.8.8.8
  • Routing table manipulation: GetIpForwardTable, CreateIpForwardEntry, DeleteIpForwardEntry, FlushIpNetTable — redirects victim traffic
  • UAC bypass: computerdefaults.exe (high-integrity COM elevation), winver.exe technique
  • Integrity level detection: checks Medium, High Integrity, System Integrity
  • Installation path: \Golden\ (matches "Golden Club Corpration." branding)
  • Registry: Software\Classes\CLSID\ + \Shell\Manage\command (shell handler hijacking)
  • Process creation: explorer.exe shell::: (spawns Explorer to break process chain)
  • Bot ID generation: CoCreateGuid → StringFromCLSID
  • RPC async communication: NdrAsyncClientCall, RpcAsyncInitializeHandle

Stage 2 Embedded Resources:

ResourceIDSizeNotes
Encrypted blob A2201131,072 bytesEntropy 8.00 — AES-encrypted
Encrypted blob B2203131,072 bytesEntropy 8.00 — AES-encrypted
Stage 3 PE2159342,528 bytesMZ header — another UPX binary

Stage 3 — ValleyRAT Core RAT (conhost.exe masquerade)

Hashes:

  • SHA256: 4a27b00d07c618eb0f58137ef3f01adc3d6963da2aae6cd23fe5e8b6aafe8e8e
  • MD5: 5e1b156ac3db0b0b056193ebf62d08d3

Architecture: 64-bit PE, compiled 2026-03-12 23:59:47 UTC. Packing: UPX 4.2.2 — unpacked from 342,528 to 1,018,880 bytes. Masquerade: Version info:

  • CompanyName: ReCommer
  • FileDescription: conhost.exe
  • InternalName: conhost.exe
  • OriginalFilename: conhost.exe
  • ProductName: ConHost
  • FileVersion: 23.2026.3.5
  • LegalCopyright: ReCommer Copyright © 2026

The RAT impersonates the Windows Console Host (conhost.exe), a trusted system binary.

Core Capabilities:

1. Vulnerable Driver Blocklist Bypass

Chinese debug string (GBK-encoded): 两个 Config 路径不存在，已创建并设置 VulnerableDriverBlocklistEnable 为 0。 Translation: "Both Config paths do not exist, have been created and set VulnerableDriverBlocklistEnable to 0."

Registry keys modified:

  • HKLM\SYSTEM\ControlSet001 → VulnerableDriverBlocklistEnable = 0
  • HKLM\SYSTEM\CurrentControlSet → VulnerableDriverBlocklistEnable = 0

This disables Windows Defender's driver blocklist, allowing installation of revoked or vulnerable kernel-mode drivers. The malware explicitly handles: "The driver's certificate has been revoked."

2. BYOVD Kernel Driver Installation

  • Driver name: DiskDump Driver
  • Debug strings: DiskDump Driver Installing..., LOAD DRIVER 权限已成功启用。 ("LOAD DRIVER privilege has been successfully enabled.")
  • Registry service path: \Registry\Machine\System\CurrentControlSet\services\
  • Driver attributes set: ImagePath, Type
  • Load sequence: RtlInitUnicodeString → RtlAdjustPrivilege (SeLoadDriverPrivilege) → NtLoadDriver
  • Error handling: [-] Driver Not Dropped, [-] Driver Not Loaded, Driver Load error..

3. Task Scheduler Persistence

Full task lifecycle implemented:

  • Create task → Register task → Set trigger → Run task → Check task state → Delete task
  • WMI query: SELECT * FROM Win32_ScheduledJob WHERE Name = '...'
  • Functions: Task Service connection, task definition manipulation, principal manipulation
  • Additional WMI: SELECT ExecutablePath FROM Win32_Process WHERE ProcessId = ...

4. UAC Bypass

  • ~Start.exe + RunExternalUAC, RunUAC — drops a helper binary for elevation
  • Uses computerdefaults.exe technique (Sigma high rule: UAC Bypass Tools Using ComputerDefaults)
  • GUID-based COM object: 201ef99a-7fa0-444c-9399-19ba84f12a1a
  • Window station: WinSta0\Default
  • Named pipe RPC: ncalrpc protocol

5. Network Communication

  • C2 IP: 103.210.238.29 (double-base64 encoded in .rdata)
  • Protocol: Raw TCP sockets (WS2_32.dll: socket, connect, send, recv, recvfrom)
  • HTTP: Host: header, HTTP/1.1 (also makes HTTP requests for geolocation)
  • Fallback error handling: Could not connect. Error code = , Could not connect. Error:

6. Anti-Analysis

  • IsDebuggerPresent check
  • NtQueryInformationProcess (ProcessDebugPort)
  • Privilege check: [-] No SeDebugPriv. — attempts SeDebugPrivilege
  • Anti-debug string: obfuscated code around You Got [...] Stopped (evasion marker)

7. Service Control Manager Operations

  • OpenServiceW, CloseServiceHandle, DeleteService — service lifecycle management
  • SetSecurityDescriptorDacl — DACL manipulation for privilege escalation

Infection Chain / Kill Chain

[Stage 1: SQL3.DLL - 32-bit loader DLL]
    |
    | 1. All 200+ exports → 0x3DE0 (single entry point)
    | 2. LoadResource("RDATA", 101) → 792KB encrypted blob
    | 3. Decrypt → Stage 2 PE (MZ)
    |
    ↓
[Stage 2: UPX-packed 64-bit dropper]
    |
    | 1. Unpacks via UPX stub
    | 2. ip-api.com/json/ → countryCode check (geo-filtering)
    | 3. DnsFlushResolverCache (8.8.8.8)
    | 4. Routing table manipulation (IPHLPAPI)
    | 5. UAC bypass (computerdefaults.exe / winver.exe)
    | 6. Drops ~Start.exe for elevation
    | 7. Explorer.exe spawn (process chain break)
    | 8. Decodes C2: TVRBek... → MTAzL... → 103.210.238.29
    | 9. Drops Stage 3 from resource 2159
    |    Encrypted resources 2201+2203 → AES-encrypted payloads
    |
    ↓
[Stage 3: UPX-packed 64-bit RAT (conhost.exe masquerade)]
    |
    | 1. Unpacks via UPX stub
    | 2. Disables VulnerableDriverBlocklistEnable in registry
    | 3. Extracts + drops DiskDump kernel driver
    | 4. RtlAdjustPrivilege(SeLoadDriverPrivilege)
    | 5. NtLoadDriver(\Registry\Machine\SYSTEM\CurrentControlSet\services\DiskDump)
    | 6. Task Scheduler persistence (trigger-based)
    | 7. GUID generation (UuidCreate) for bot ID
    | 8. Connect to 103.210.238.29 for C2
    |
    ↓
[KERNEL MODE: DiskDump driver]
    | - Rootkit-level access
    | - EDR/AV evasion at kernel level
    ↓
[COMPROMISED HOST]

Behavioral Analysis (Inferred)

BehaviorEvidence
Geo-filteringip-api.com countryCode check (likely skips China, possibly CN/TW)
DLL Side-loadingSQL3.DLL loaded by legitimate app expecting sqlite3.dll
Process hollowing/injectionExplorer.exe spawn + process chain break
Credential harvestingLikely via kernel driver (BYOVD)
PersistenceTask Scheduler + Registry \Shell\Manage\command
Defense evasionVulnerableDriverBlocklistEnable=0, kernel driver, anti-debug
C2 beaconRaw TCP to 103.210.238.29, HTTP/1.1 with Host header
DiscoveryProcess enumeration (CreateToolhelp32Snapshot), WMI queries
Privilege escalationUAC bypass (computerdefaults.exe), driver privilege escalation

Network Indicators

C2 Infrastructure

IndicatorTypeDetails
103.210.238.29C2 IPv4Primary C2 server

Hosting details for 103.210.238.29:

  • Network: HKKFGL-HK — HK Kwaifong Group Limited
  • Country: Hong Kong (HK)
  • Network Range: 103.210.236.0 – 103.210.239.255
  • Abuse contact: abuse@kfglobal.hk
  • APNIC Org: ORG-HKIS1-AP
  • Shodan/InternetDB: No results (C2 spun up recently, same day as sample)

Encoding: C2 IP stored as double-base64 in both Stage 2 and Stage 3:

Layer 1: TVRBekxqSXhNQzR5TXpndU1qaz0=
Layer 2: MTAzLjIxMC4yMzguMjk=
Plaintext: 103.210.238.29

Port: Not recovered from static analysis (not base64-encoded; possibly in AES-encrypted config blobs 2201/2203). Active port scan (2026-03-13): host responds to TCP but ports 80, 443, 6666, 7777, 8888, 8080, 9999, 12345 all filtered/closed. C2 likely uses non-standard high port or strict allowlist firewall. Common ValleyRAT C2 ports observed in other campaigns: 6666, 7777, 8888.

Geolocation Check

IndicatorTypeNotes
ip-api.comFQDNIP geolocation service
http://ip-api.com/json/URLVictim country discovery
208.95.112.1IPv4ip-api.com resolved IP (in sandbox)

MITRE ATT&CK TTPs

TechniqueIDDescription
DLL Side-LoadingT1574.002SQL3.DLL loaded by app expecting sqlite3.dll
MasqueradingT1036.005Masquerades as SQL3.DLL, MpCmdRun.exe, MpDefenderCoreService.exe, conhost.exe
Obfuscated FilesT1027.013Double base64 encoding of C2 IP and binary names
Resource ForkingT1564.009Payload embedded in PE resource section (.rsrc)
Virtualization/Sandbox EvasionT1497.001IsDebuggerPresent, NtQueryInformationProcess
System Location DiscoveryT1614.001ip-api.com countryCode check
UAC Bypass: COM Object ElevationT1548.002computerdefaults.exe UAC bypass
Exploit Kernel DriverT1543.003Windows Service (DiskDump driver) via NtLoadDriver
BYOVDT1014Disable driver blocklist + load kernel rootkit
Impair DefensesT1562.010VulnerableDriverBlocklistEnable = 0
Scheduled Task PersistenceT1053.005Task Scheduler full lifecycle
Registry Run KeysT1547.001Shell\Manage\command + CLSID registration
System Binary Proxy ExecutionT1218.011rundll32, regsvr32 execution chain
Process InjectionT1055Explorer process tree break
Native APIT1106NtLoadDriver, NtQueryInformationProcess, NtDuplicateObject
Process DiscoveryT1057CreateToolhelp32Snapshot, WMI Win32_Process
System Service DiscoveryT1007OpenServiceW, service enumeration
Network Configuration DiscoveryT1016GetAdaptersInfo, GetIpForwardTable
Exfiltration Over C2T1041Raw TCP + HTTP to C2 IP
Bot Unique IDT1033CoCreateGuid/UuidCreate for bot fingerprint

IOCs

File Hashes

Hash TypeStage 1 DLLStage 2 DropperStage 3 RAT
SHA2561144433760a0683413a85da271bc37ff9f296ac287e722825f27577b529b9d27c9a152ce795cad9b667a64b66abe473ff89310486c00a0b83f420ddb3db2548a4a27b00d07c618eb0f58137ef3f01adc3d6963da2aae6cd23fe5e8b6aafe8e8e
MD58e8319ef77aa12f2335b339abf0ddadb8fdfc384f8c423b2452adb819c989b975e1b156ac3db0b0b056193ebf62d08d3

Network IOCs

IndicatorTypeContext
103.210.238.29IPv4C2 server (HK Kwaifong Group Ltd, Hong Kong)
ip-api.comFQDNGeo-filtering check
http://ip-api.com/json/URLVictim IP/country lookup

Registry IOCs

KeyValueNotes
HKLM\SYSTEM\ControlSet001VulnerableDriverBlocklistEnable = 0Disables WDAC driver blocklist
HKLM\SYSTEM\CurrentControlSetVulnerableDriverBlocklistEnable = 0Disables WDAC driver blocklist
HKLM\SYSTEM\CurrentControlSet\services\DiskDumpImagePath = <driver path>Kernel driver service
HKLM\Software\Classes\CLSID\{...}—COM object registration
HKLM\Software\Classes\CLSID\{...}\Shell\Manage\command—Shell command hijacking

File System IOCs

PathNotes
<TempPath>\SQL3.DLLStage 1 loader DLL
\Golden\Installation directory (linked to "Golden Club" campaign)
~Start.exeUAC elevation helper
conhost.exe (malicious copy)Stage 3 RAT masquerade
Setup.exe (malicious)Dropper masquerade name

Process / Behavioral IOCs

IndicatorNotes
explorer.exe spawned by rundll32.exeRunDLL32 spawning Explorer (Sigma HIGH)
computerdefaults.exe spawnedUAC bypass via ComputerDefaults (Sigma HIGH)
powershell.exe non-interactivePowerShell spawning (Sigma MEDIUM)
svchost.exe unusual parametersUncommon Svchost (Sigma HIGH)
GUID 201ef99a-7fa0-444c-9399-19ba84f12a1aCOM object used for UAC bypass

Mutex / Unique Identifiers

ValueNotes
BtCpH9Possible mutex or key string found in encrypted region
ru=IPH9=Possible encoded identifier
yangeshi (DLL export)Chinese word "style" — threat actor artifact

Campaign Context

  • Operator name: Golden Club (based on fake company name "Golden Club Corpration." — note deliberate typo)
  • Campaign: ValleyRAT variant E — ongoing campaign with fresh compile timestamps (same-day compilation)
  • Hosting: C2 at HK Kwaifong Group Limited (Hong Kong) — a commonly abused Hong Kong VPS provider for Chinese-nexus actors

Compilation Artifacts

  • Stage 1 DLL compiled: 2026-03-13 00:01:27 UTC
  • Stage 2 dropper compiled: 2026-03-13 00:00:51 UTC
  • Stage 3 RAT compiled: 2026-03-12 23:59:47 UTC
  • All three stages compiled within ~2 minutes of each other, 15 hours before first submission — fresh build

Chinese Language Artifacts

All GBK-encoded debug strings are in Simplified Chinese, indicating a Chinese-speaking developer:

  • 两个 Config 路径不存在，已创建并设置 VulnerableDriverBlocklistEnable 为 0。 — "Both Config paths do not exist; have been created and VulnerableDriverBlocklistEnable set to 0."
  • LOAD DRIVER 权限已成功启用。 — "LOAD DRIVER privilege has been successfully enabled."
  • 分配磁盘 : — "Allocate disk :"

Attribution

AttributeAssessmentConfidence
Malware FamilyValleyRAT (variant E)HIGH — ESET, Rising, CTX confirmed
LanguageSimplified ChineseHIGH — GBK-encoded debug strings
Threat ActorSilver Fox / "Golden Club" operatorMEDIUM — branding, infrastructure
NexusChina (PRC)MEDIUM — Chinese strings, HK C2 hosting
TargetLikely financial/tech (typical ValleyRAT targeting)MEDIUM
DeliveryDLL side-loading via fake sqlite3HIGH — confirmed by export table

OPSEC mistakes:

  1. Deliberate typo "Corpration" (instead of "Corporation") — reused brand identifier
  2. yangeshi export left in DLL — Chinese word leaking operator language
  3. GBK-encoded debug strings not stripped — developer operating environment leaked
  4. Compile times within 2 minutes of each other — same build system, same session

Infrastructure Map

[103.210.238.29] — C2 Server
    |
    ├── Network: 103.210.236.0/22 (HKKFGL-HK)
    ├── Provider: HK Kwaifong Group Limited
    ├── Country: Hong Kong
    ├── Abuse: abuse@kfglobal.hk
    └── Status: Fresh (no prior Shodan/InternetDB data — spun up same day)

[ip-api.com] — Geo-filtering
    |
    ├── IP: 208.95.112.1
    └── Protocol: HTTP/1.1 GET /json/
Share