Hackers Use Fake VLC Executable and Malicious libvlc.dll to Deploy ValleyRAT

This report details a phishing-driven campaign that leverages a genuine VLC executable paired with a malicious libvlc.dll to sideload and deploy ValleyRAT. The operators use ZIP-based lures targeting Chinese and Japanese users, RC4-encrypted in-memory payloads with process injection (fileless execution), sandbox-avoidance checks, and persistence via registry autorun; the write-up includes multiple indicators of compromise (hashes, domain, URL) and remediation recommendations.