Cracking ValleyRAT From Builder Secrets to Kernel Rootkits

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://research.checkpoint.com/2025/cracking-valleyrat-from-builder-secrets-to-kernel-rootkits/
• Blog Title: Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits
• Suggested Section: 🪟 Windows Hardening -> Windows Local Privilege Escalation (new subsections for 'MalSeclogon & PPID Spoofing' and 'Windows Kernel Rootkit Techniques: APC Injection, Registry-Driven Stealth, Forced Deletion, Legacy-Signed Driver Abuse')

🎯 Content Summary

This blog post presents a deep reverse-engineering analysis of the ValleyRAT (a.k.a. Winos/Winos4.0) modular backdoor, focusing on its leaked builder, full plugin ecosystem, and an embedded Windows kernel-mode rootkit. The research is based on two main public GitHub repositories: a recent builder/C2 panel (Quick.exe) and an older Visual Studio solution structure (without source code). By correlating PE resources with Visual Studio project names, the authors reconstruct the architecture, extra...

🔧 Technical Details

Modular RAT architecture with plugin-based capabilities
ValleyRAT demonstrates a generic pattern for building a modular RAT: use a builder that embeds multiple plugins (DLLs/EXEs) as PE resources, then generate first‑stage modules (like an “Online Module” or “Login Module”) that beacon to a C2 and dynamically load specific capability plugins based on operator decisions. Each plugin communicates over a plugin‑specific TCP/UDP protocol with custom XOR‑based serialization and implements a focused feature set (file manager, keylogger, remote screen, DDoS, proxy tunneling, etc.). This decoupled architecture allows operators to minimize footprint per victim and update or swap capabilities without changing the core loader.

Reliable extraction and correlation of embedded PEs
The blog shows a practical forensic and hunting pattern for analyzing complex PE containers: combine a smart carving tool (e.g., Detect-It-Easy’s extractor) with ...

🤖 Agent Actions

Updated src/windows-hardening/windows-local-privilege-escalation/README.md with two new technique-focused sections:

1. MalSeclogon & PPID Spoofing for stealth driver installs – documents how attackers chain FileProcessIdsUsingFileInformation, TEB ClientId edits, and MalSeclogon token theft to make dwm.exe appear as the parent of noisy helper commands before installing a signed driver, plus defender-oriented detection cues.

2. Windows Kernel Rootkit Techniques: APC injection, registry-driven stealth, forced deletion & legacy-signed drivers – covers ValleyRAT’s kernel module capabilities, including KernelQuick_* registry-controlled hide lists, APC-based shellcode delivery from HKLM\SOFTWARE\IpDates, ForceDeleteFile() AV/EDR removal, boot-start persistence upgrades, and abuse of legacy cross-signed certificates, alongside hunting ideas.

Also appended the Check Point “Cracking ValleyRAT” report to the References section.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://research.checkpoint.com/2025/cracking-valleyrat-from-builder-secrets-to-kernel-rootkits/

Content Categories: Based on the analysis, this content was categorized under "🪟 Windows Hardening -> Windows Local Privilege Escalation (new subsections for 'MalSeclogon & PPID Spoofing' and 'Windows Kernel Rootkit Techniques: APC Injection, Registry-Driven Stealth, Forced Deletion, Legacy-Signed Driver Abuse')".

Repository Maintenance:

• MD Files Formatting: 915 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0