APT Silver Fox is using a stock investment decoy and undocumented Windows API functions to evade detection
Summary ValleyRAT is a remote access Trojan program used by the Silver Fox threat organization. I did threat hunting and found a lot of samples, but here I just analyzed one of them. Technical analysis ValleyRAT md5: 6923AB76F93C6D48B025D27A37E20D14 Portable executable for 80386 (PE) Figure1-basic info Release malware and decoy ValleyRAT will release both Trojan “moomoo x64.exe” and decoy UUU.pdf in the directory “%LocalAppData%\Temp\,” and at the same time it starts a process, IE browser like msedge.exe, to open UUD.pdf, which is to attract the attention of the victim to cover the real motivation, the content of the PDF is written in Japanese about how to invest in the stock market, which seems the attacker is focused on the specific potential victims; in the background it also starts another Trojan process of “moomoo x64.exe.”. Firgure2-Stock market guide The traffic between client and server When the process of “moomoo x64.ex...