Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
Cracking Valleyrat: from Builder Secrets to Kernel Rootkits
Threat Actors
Malware Families
Excerpt
https://research.checkpoint.com/2025/cracking-valleyrat-from-builder-secrets-to-kernel-rootkits/ Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits By shlomoo@checkpoint.com Published: 2025-12-10 · Archived: 2026-10-27 02:14:54 UTC Highlights: Check Point Research (CPR) presents a full dissection of the widely used ValleyRAT backdoor, also known as Winos/Winos4.0, covering its modular architecture and plugin system. By analyzing the publicly leaked builder and…
Read the original report →Diamond Model
Adversary(2)
Infrastructure(6)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | authentihash_lief.py | High | Score 67/100 | First seen |
| URL | https://www.angusj.com/resourcehacker/ | High | Score 67/100 | First seen |
| URL | rat.com/ | High | Score 67/100 | First seen |
| Domain | args.directory | High | Score 67/100 | First seen |
| URL | https://lief.re/ | High | Score 67/100 | First seen |
| URL | https://www.sun-rat.com/ | High | Score 67/100 | First seen |
IOC Relationship Graph
Building graph…