Procedure examples

Valak can communicate over multiple C2 hosts.

Valak can use the Registry for code updates and to collect credentials.

Valak has the ability to identify the domain and the MAC and IP addresses of an infected machine.

Valak has the ability to base64 encode and XOR encrypt strings.

Valak has used packed DLL payloads.

Valak has the ability to store information regarding the C2 server and downloads in the Registry key HKCU\Software\ApplicationContainer\Appsw64.

Valak can gather information regarding the user.

Valak has the ability to exfiltrate data over the C2 channel.

Valak can use wmic process call create in a scheduled task to launch plugins and for execution.

Valak has used scheduled tasks to execute additional payloads and to gain persistence on a compromised host.

Valak has the ability to enumerate running processes on a compromised host.

Valak has used PowerShell to download additional modules.

Valak can execute JavaScript containing configuration data for establishing persistence.

Valak has used HTTP in communications with C2.

Valak can determine the Windows version and computer name on a compromised host.

Valak has the ability to enumerate local admin accounts.

Valak has the ability to enumerate domain admin accounts.

Valak can download additional modules and malware capable of using separate C2 channels.

Valak has downloaded a variety of modules and payloads to the compromised host, including IcedID and NetSupport Manager RAT-based malware.

Valak has the ability to modify the Registry key HKCU\Software\ApplicationContainer\Appsw64 to store information regarding the C2 server and downloads.

Valak has the ability to take screenshots on a compromised host.

Valak can collect sensitive mailing information from Exchange servers, including credentials and the domain certificate of an enterprise.

Valak can download a module to search for and build a report of harvested credential data.

Valak has returned C2 data as encoded ASCII.

Valak has the ability to decode and decrypt downloaded files.

Valak has been executed via Microsoft Word documents containing malicious macros.

Valak has used regsvr32.exe to launch malicious DLLs.

Valak can determine if a compromised host has security products installed.

Valak can use the clientgrabber module to steal e-mail credentials from the Registry.

Valak can use a .NET compiled module named exchgrabber to enumerate credentials from the Credential Manager.

Valak can execute tasks via OLE.

Valak has the ability save and execute files as alternate data streams (ADS).

Valak has been delivered via spearphishing e-mails with password protected ZIP files.

Valak has been delivered via malicious links in e-mail.