ValakMalware
- valek
According to PCrisk, Valak is malicious software that downloads JScript files and executes them. What happens next depends on the actions performed by the executed JScript files. It is very likely that cyber criminals behind Valak attempt to use this malware to cause chain infections (i.e., using Valak to distribute other malware).From MISP Galaxy
Last reported 4 years ago, by Huntress1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1047Windows Management Instrumentation
“We then see the code prepare both an execCommand and taskCommand separately, using the Windows Management Instrumentation (WMI) and a “task” to execute the code.”
- T1053.005Scheduled Task
“…ding an extra minute to the current time and the creation of a “task” variable leads us to believe the malware is in fact creating a Scheduled Task to execute what it needs to.”
What the reports say
1 report, newest first · the exact sentence from each-
Bring Your Own Command & Control (BYOC2)“After further research, it seems this sample is dubbed throughout the community as "Valak."”
Indicators in its reports
named in the reports above- hxxp://onecs-live.azureedge[.]netin 1 report
- onecs-live.azureedge[.]netin 1 report
- hxxp://tauhutxiga[.]comin 1 report
- tauhutxiga[.]comin 1 report
- hxxp://monsuperentrepreneur[.]comin 1 report
- monsuperentrepreneur[.]comin 1 report
- hxxp://tangocation[.]comin 1 report
- tangocation[.]comin 1 report
- hxxp://e4a24fb0e[.]comin 1 report
- e4a24fb0e[.]comin 1 report
- hxxp://f78efaf43b[.]comin 1 report
- f78efaf43b[.]comin 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.