MITRE ATT&CKsoftware (malware)
S0476 Valak
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.3
- Created
- 2020-06-19
Description
Valak is a multi-stage modular malware that can function as a standalone information stealer or downloader, first observed in 2019 targeting enterprises in the US and Germany.
Related
Uses · MITRE ATT&CK (34)
- T1027.011 Fileless Storage sub-technique
- T1555.004 Windows Credential Manager sub-technique
- T1059.007 JavaScript sub-technique
- T1071.001 Web Protocols sub-technique
- T1132.001 Standard Encoding sub-technique
- T1564.004 NTFS File Attributes sub-technique
- T1204.002 Malicious File sub-technique
- T1059.001 PowerShell sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1087.001 Local Account sub-technique
- T1087.002 Domain Account sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1114.002 Remote Email Collection sub-technique
- T1559.002 Dynamic Data Exchange sub-technique
- T1027.002 Software Packing sub-technique
- T1552.002 Credentials in Registry sub-technique
- T1218.010 Regsvr32 sub-technique
- T1053.005 Scheduled Task sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1008 Fallback Channels technique
- T1012 Query Registry technique
- T1016 System Network Configuration Discovery technique
- T1027 Obfuscated Files or Information technique
- T1033 System Owner/User Discovery technique
- T1041 Exfiltration Over C2 Channel technique
- T1047 Windows Management Instrumentation technique
- T1057 Process Discovery technique
- T1082 System Information Discovery technique
- T1104 Multi-Stage Channels technique
Referenced by MITRE ATT&CK · uses (1)
- G0127 TA551 group
References
- https://unit42.paloaltonetworks.com/valak-evolution/ Unit 42 Valak July 2020
- https://www.cybereason.com/blog/valak-more-than-meets-the-eye Cybereason Valak May 2020