Unit 42 Valak July 2020

Valak can communicate over multiple C2 hosts.

Valak can use the Registry for code updates and to collect credentials.

Valak has the ability to base64 encode and XOR encrypt strings.

TA551 has used obfuscated variable names in a JavaScript configuration file.

Valak has the ability to store information regarding the C2 server and downloads in the Registry key HKCU\Software\ApplicationContainer\Appsw64.

Valak has the ability to exfiltrate data over the C2 channel.

Valak has used scheduled tasks to execute additional payloads and to gain persistence on a compromised host.

TA551 has used HTTP for C2 communications.

Valak has used HTTP in communications with C2.

Valak can download additional modules and malware capable of using separate C2 channels.

Valak has downloaded a variety of modules and payloads to the compromised host, including IcedID and NetSupport Manager RAT-based malware.

Valak has the ability to modify the Registry key HKCU\Software\ApplicationContainer\Appsw64 to store information regarding the C2 server and downloads.

Valak has returned C2 data as encoded ASCII.

TA551 has used encoded ASCII text for initial C2 communications.

Valak has the ability to decode and decrypt downloaded files.

Valak has been executed via Microsoft Word documents containing malicious macros.

Valak has used regsvr32.exe to launch malicious DLLs.

TA551 has used regsvr32.exe to load malicious DLLs.

Valak has the ability save and execute files as alternate data streams (ADS).

TA551 has sent spearphishing attachments with password protected ZIP files.

Valak has been delivered via spearphishing e-mails with password protected ZIP files.