ValleyRAT_S2: Stealth Intrusions Aimed at Financial Data Exfiltration

ValleyRAT_S2 is a modular, C++ second-stage Remote Access Trojan active across Chinese-speaking regions and Southeast Asia, delivered via DLL side-loading, fake "AI" tools, cracked software, and targeted phishing; it performs extensive system reconnaissance, establishes persistence (Task Scheduler, Volume Shadow Copy), uses process injection and DLL masquerading for evasion, logs keystrokes, and exfiltrates data to hardcoded C2 servers (e.g., 27.124.3.175:14852).