Cybereason Valak May 2020

Valak has the ability to identify the domain and the MAC and IP addresses of an infected machine.

Valak has the ability to base64 encode and XOR encrypt strings.

Valak has the ability to store information regarding the C2 server and downloads in the Registry key HKCU\Software\ApplicationContainer\Appsw64.

Valak can gather information regarding the user.

Valak has the ability to exfiltrate data over the C2 channel.

Valak has used scheduled tasks to execute additional payloads and to gain persistence on a compromised host.

Valak has the ability to enumerate running processes on a compromised host.

Valak has used PowerShell to download additional modules.

Valak can execute JavaScript containing configuration data for establishing persistence.

Valak has used HTTP in communications with C2.

Valak can determine the Windows version and computer name on a compromised host.

Valak has the ability to enumerate local admin accounts.

Valak has the ability to enumerate domain admin accounts.

Valak has downloaded a variety of modules and payloads to the compromised host, including IcedID and NetSupport Manager RAT-based malware.

Valak has the ability to modify the Registry key HKCU\Software\ApplicationContainer\Appsw64 to store information regarding the C2 server and downloads.

Valak has the ability to take screenshots on a compromised host.

Valak can collect sensitive mailing information from Exchange servers, including credentials and the domain certificate of an enterprise.

Valak has the ability to decode and decrypt downloaded files.

Valak has been executed via Microsoft Word documents containing malicious macros.

Valak has used regsvr32.exe to launch malicious DLLs.

Valak can determine if a compromised host has security products installed.

Valak has the ability save and execute files as alternate data streams (ADS).