PNGPlug Loader Distributes ValleyRAT Malware via Deceptive Software Installers
January 21, 2025
Cyber Attack / Windows Security
Cybersecurity experts are raising alarms about a series of cyber attacks targeting Chinese-speaking regions, including Hong Kong, Taiwan, and Mainland China, involving the notorious ValleyRAT malware. According to a technical report by Intezer published last week, these attacks utilize a multi-stage loader known as PNGPlug to deliver the ValleyRAT payload. The infection process starts with a phishing page designed to lure victims into downloading a malicious Microsoft Installer (MSI) disguised as legitimate software. Once executed, the installer presents a harmless application to evade detection while covertly extracting an encrypted archive that contains the malware. The MSI package exploits the Windows Installer’s CustomAction feature, allowing it to run malicious code, including an embedded DLL that decrypts the archive (all.zip) using a hardcoded password, ‘hello202411’, to release the core malware components.
Cyber Attack / Windows Security
PNGPlug Loader Facilitates ValleyRAT Malware Distribution via Deceptive Software Installers January 21, 2025 Cyber Attack / Windows Security Cybersecurity experts are raising alarms over a sophisticated series of cyberattacks targeting Chinese-speaking regions, including Hong Kong, Taiwan, and Mainland China. The…
