An Analysis of ValleyRAT Infection Campaigns from Fake Installers, Japanese Malicious Emails

LevelBlue’s GSOC report analyzes ValleyRAT activity observed since 2025, documenting two primary attack vectors (fake installers and malicious emails), describing a detailed malicious-email campaign that uses ZIP-delivered EXE+DLL sideloading, fileless RC4-encrypted payloads executed via Donut-generated shellcode and process injection, multiple anti-analysis checks, detection logic, IOCs, and recommended prevention/remediation steps.