ValleyRAT Uses RC4 Encryption, Donut Shellcode, and rundll32 Injection for Stealth

A recent surge in ValleyRAT activity that combines RC4-encrypted payloads, Donut-generated shellcode, and in-memory execution via suspended rundll32 processes to evade detection.

First named by Proofpoint in 2023, ValleyRAT continues to evolve: LevelBlue’s telemetry shows a marked increase in successful detections beginning May 2025 and accelerating into 2026.

The threat now presents through two primary vectors fake installers and malicious email campaigns each tailored with language-specific lures and robust anti-analysis checks that complicate investigative and defensive efforts.

The malicious email campaign analyzed by LevelBlue targets Chinese- and Japanese-speaking users and begins with a URL that delivers a ZIP archive containing an EXE and a DLL.

The EXE is a legitimate-looking binary (metadata often mimics VLC or other trusted software) used to sideload the malicious DLL.

Once the DLL is loaded, it performs persistence and retrieval functions while applying several evasion techniques: junk-code padding, memory-size checks, sleep-duration validation, processor-count verification, and an IsNativeVhdBoot() check to avoid virtualized sandboxes.

Persistence is typically achieved by copying files into C:\Users\Public\Documents\res\ and creating a Run-key registry entry to execute a renamed executable on logon.

The download stage is notable for its fileless emphasis and custom encryption. The DLL fetches the final ValleyRAT payload from a Base64-encoded URL and decrypts it using RC4 with the embedded key “zenzensu.”

Rather than writing the decrypted payload to disk, the malware creates a suspended rundll32.exe process and injects the RC4-decrypted shellcode into the process memory via VirtualAllocEx() and WriteProcessMemory(), then resumes execution with ResumeThread().

LevelBlue said in a report shared with GBhackers, has identified two distinct attack vectors associated with ValleyRAT: campaigns leveraging fake installers and campaigns initiated through malicious emails.

This suspended-process injection preserves stealth by avoiding disk artifacts and leveraging a legitimate Windows binary to blend into process listings.

ValleyRAT Uses RC4 Encryption

Analysis of a sample retrieved from VirusTotal revealed that the in-memory payload was generated with Donut, a PIC shellcode generator frequently used to convert .NET assemblies into position-independent shellcode executable from memory.

Using the publicly available donut-decryptor, LevelBlue recovered the original assembly and confirmed persistent behaviors consistent with previously reported ValleyRAT samples, reinforcing attribution challenges.

While some reports link ValleyRAT to SilverFox and BYOVD techniques, leaked builders and variant diversity indicate the malware is used by multiple actors or sold as a commodity.

LevelBlue’s detection approach combines behavioral hunting with indicators drawn from leaked ValleyRAT project access names and module filenames.

Several ValleyRAT leak datasets are publicly available. The particular leak referenced during the development of this query contained multiple Visual Studio project files. 

One proactive hunting query flags floating modules matching known ValleyRAT names, but analysts caution that such logic can produce false positives; therefore it is run under LevelBlue’s Proactive Hunting model rather than as an automatic MalOp alert.

This hunting model tolerates higher noise and relies on human validation before customer notification.

Mitigations focus on email hygiene, user awareness, and endpoint visibility. Organizations should train employees to treat unexpected business-related messages from free email providers with suspicion, block suspicious ZIP-download links at the mail gateway, and deploy EDRs capable of detecting DLL sideloading, Donut shellcode execution, and in-memory injection patterns.

For organizations seeking managed support, LevelBlue’s MDR and Proactive Hunting services provide tailored detection rules and analyst validation to reduce operational burden.

For deeper context, see Proofpoint’s initial ValleyRAT write-up and subsequent research on ValleyRAT builder leaks and BYOVD methods, as well as public resources on Donut-generated shellcode and donut-decryptor tools.

IOCs

IOC	IOC type	Description
e8be03f19ada1f5cec74b143e21d4939e781671d	SHA1	Malicious email
frehf.oss-cn-hongkong.aliyuncs[.]com	Domain	Domain part of the URLin the malicious email
65168c8dd93b16d3b77092fb70c0fa6fba4dffcc	SHA1	ZIP archive
http://154.92.16[.]22/xz.bin	URL	ValleyRAT download URL
eca7ed7b699835fadc2c2997a2845864e02b8dfe	SHA1	ValleyRAT sample encrypted by RC4

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.