Signed Overwolf Binary Sideloads ValleyRAT Malware in India
A phishing campaign targets Indian organizations by impersonating the Indian Income Tax Department. Victims receive emails containing links to spoofed notice pages that download ZIP archives. These archives include a legitimately signed Overwolf executable and two hidden files: a malicious DLL and an encrypted binary. When executed, the signed binary side-loads the malicious DLL through DLL hijacking. The DLL is UPX-packed and modified with Astral-PE, and decrypts the binary file containing ValleyRAT. The payload uses modified RC4 encryption with a 115-byte key and deploys entirely in memory. Once active, ValleyRAT establishes persistence through scheduled tasks masquerading as OneDrive entries, marks dropped files as hidden and system files, and performs process hollowing into svchost.exe to evade detection before connecting to command and control infrastructure.
AI Analysis
Technical Summary
The threat involves a phishing campaign aimed at Indian organizations where emails impersonate the Indian Income Tax Department and deliver ZIP archives with a signed Overwolf executable and malicious payloads. The signed executable side-loads a UPX-packed and Astral-PE modified DLL through DLL hijacking. This DLL decrypts an embedded binary containing ValleyRAT, which uses a modified RC4 encryption with a 115-byte key and loads entirely in memory (reflective loading). ValleyRAT achieves persistence by creating scheduled tasks disguised as OneDrive entries, marks its files as hidden and system files, and evades detection by performing process hollowing into svchost.exe before communicating with its command and control servers.
Potential Impact
The campaign enables attackers to deploy ValleyRAT malware on victim systems, allowing persistent remote access and stealthy operation through process hollowing and file attribute manipulation. This can lead to unauthorized data access, system compromise, and potential lateral movement within targeted Indian organizations.
Mitigation Recommendations
No patch or official fix is available as this is a malware campaign leveraging social engineering and signed binary sideloading. Mitigation should focus on user awareness to detect phishing attempts impersonating the Indian Income Tax Department, blocking malicious email attachments and links, monitoring for suspicious scheduled tasks especially those masquerading as legitimate services like OneDrive, and employing endpoint detection solutions capable of identifying DLL sideloading, process hollowing, and reflective loading behaviors.
Affected Countries
India
Indicators of Compromise
- hash: 2d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d
- hash: 315bda377beafb746f1c2f4fba430867
- hash: 62e3ba37a23669139a222cd43ec2b202277a4030
- ip: 103.240.196.115
- hash: 061f3e304c65f3f062f2aacc41b6d6f8a4f43816
- hash: 07846091fdeb1011cbd80d9ca45fd7dcb40b5c40
- hash: 2d830905581ae5c29d1e6bad27c6b63a097f79d7
- hash: 7de942da8993a45a5a7547de0a883f9b13f2f71c
- hash: ab530af5603ce3f98b51b3c6f612074e020f572e
- hash: d03fb03e8969e7ecbd763aa4bdc67a4629e19b10
- hash: f062e682ee38b33141ba03b17880b9cacca0e376
- url: http://cpxxw.vip/
- url: http://dnfyb.vip/
- url: http://dywwl.vip/
- url: http://kangyue.vip/
- url: http://kejiwei.vip/
- url: http://nsseo.vip/
- url: http://rpaai.vip/
- url: http://shhswz.vip/
- url: http://suoguan.vip/
- url: http://tanlianmeng.vip/
- url: http://taobaoker.vip/
- url: http://usheng.vip/
- url: http://wayaya.vip/
- url: http://yakin.vip/
- url: http://zbrhcggp.vip/
- url: https://cpxxw.vip/
- url: https://dnfyb.vip/
- url: https://dywwl.vip/
- url: https://kangyue.vip/
- url: https://kejiwei.vip/
- url: https://nsseo.vip/
- url: https://rpaai.vip/
- url: https://taobaoker.vip/
- url: https://usheng.vip/
- url: https://wayaya.vip/
Signed Overwolf Binary Sideloads ValleyRAT Malware in India
Description
A phishing campaign targets Indian organizations by impersonating the Indian Income Tax Department. Victims receive emails containing links to spoofed notice pages that download ZIP archives. These archives include a legitimately signed Overwolf executable and two hidden files: a malicious DLL and an encrypted binary. When executed, the signed binary side-loads the malicious DLL through DLL hijacking. The DLL is UPX-packed and modified with Astral-PE, and decrypts the binary file containing ValleyRAT. The payload uses modified RC4 encryption with a 115-byte key and deploys entirely in memory. Once active, ValleyRAT establishes persistence through scheduled tasks masquerading as OneDrive entries, marks dropped files as hidden and system files, and performs process hollowing into svchost.exe to evade detection before connecting to command and control infrastructure.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The threat involves a phishing campaign aimed at Indian organizations where emails impersonate the Indian Income Tax Department and deliver ZIP archives with a signed Overwolf executable and malicious payloads. The signed executable side-loads a UPX-packed and Astral-PE modified DLL through DLL hijacking. This DLL decrypts an embedded binary containing ValleyRAT, which uses a modified RC4 encryption with a 115-byte key and loads entirely in memory (reflective loading). ValleyRAT achieves persistence by creating scheduled tasks disguised as OneDrive entries, marks its files as hidden and system files, and evades detection by performing process hollowing into svchost.exe before communicating with its command and control servers.
Potential Impact
The campaign enables attackers to deploy ValleyRAT malware on victim systems, allowing persistent remote access and stealthy operation through process hollowing and file attribute manipulation. This can lead to unauthorized data access, system compromise, and potential lateral movement within targeted Indian organizations.
Defensive Guidance
No patch or official fix is available as this is a malware campaign leveraging social engineering and signed binary sideloading. Mitigation should focus on user awareness to detect phishing attempts impersonating the Indian Income Tax Department, blocking malicious email attachments and links, monitoring for suspicious scheduled tasks especially those masquerading as legitimate services like OneDrive, and employing endpoint detection solutions capable of identifying DLL sideloading, process hollowing, and reflective loading behaviors.
Affected Countries
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://www.forcepoint.com/blog/x-labs/valleyrat-overwolf-sideload-tax-scam"]
- Pulse Id
- 6a8478fe441f9c15e06ee4cc
Indicators of Compromise
Hash
| Value | Description | Copy |
|---|---|---|
hash2d2a251a88632f010fd9671789746908eeccaa5bc5c0a5d25e4649efe4f5b15d | — | |
hash315bda377beafb746f1c2f4fba430867 | — | |
hash62e3ba37a23669139a222cd43ec2b202277a4030 | — | |
hash061f3e304c65f3f062f2aacc41b6d6f8a4f43816 | — | |
hash07846091fdeb1011cbd80d9ca45fd7dcb40b5c40 | — | |
hash2d830905581ae5c29d1e6bad27c6b63a097f79d7 | — | |
hash7de942da8993a45a5a7547de0a883f9b13f2f71c | — | |
hashab530af5603ce3f98b51b3c6f612074e020f572e | — | |
hashd03fb03e8969e7ecbd763aa4bdc67a4629e19b10 | — | |
hashf062e682ee38b33141ba03b17880b9cacca0e376 | — |
Ip
| Value | Description | Copy |
|---|---|---|
ip103.240.196.115 | — |
Url
| Value | Description | Copy |
|---|---|---|
urlhttp://cpxxw.vip/ | — | |
urlhttp://dnfyb.vip/ | — | |
urlhttp://dywwl.vip/ | — | |
urlhttp://kangyue.vip/ | — | |
urlhttp://kejiwei.vip/ | — | |
urlhttp://nsseo.vip/ | — | |
urlhttp://rpaai.vip/ | — | |
urlhttp://shhswz.vip/ | — | |
urlhttp://suoguan.vip/ | — | |
urlhttp://tanlianmeng.vip/ | — | |
urlhttp://taobaoker.vip/ | — | |
urlhttp://usheng.vip/ | — | |
urlhttp://wayaya.vip/ | — | |
urlhttp://yakin.vip/ | — | |
urlhttp://zbrhcggp.vip/ | — | |
urlhttps://cpxxw.vip/ | — | |
urlhttps://dnfyb.vip/ | — | |
urlhttps://dywwl.vip/ | — | |
urlhttps://kangyue.vip/ | — | |
urlhttps://kejiwei.vip/ | — | |
urlhttps://nsseo.vip/ | — | |
urlhttps://rpaai.vip/ | — | |
urlhttps://taobaoker.vip/ | — | |
urlhttps://usheng.vip/ | — | |
urlhttps://wayaya.vip/ | — |
Threat ID: 6a84bac9c6e8be0332afc759
Added to database: 08/18/2026, 20:04:25 UTC
Last enriched: 09/17/2026, 22:01:45 UTC
Last updated: 10/02/2026, 13:41:27 UTC
Views: 108
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.