Valak

The Valak malware is a threat that appears to be utilized as a first-stage payload. The Valak threat is designed to operate very silently to avoid raising any suspicion.

This malware would compromise a system and gain persistence immediately. After gaining persistence on the host, the Valak threat will await commands from the C&C (Command & Control) server of the attackers. The Valak malware enables its operators to plant additional threats on the infected host. This threat also can:

• Take screenshots of the active windows and desktop of the victim.
• Collect passwords that are stored in the victim’s Web browsers.
• Gather system information.
• List the active processes.
• Get access to information regarding the network settings of the host.
• Receive data regarding the geographical location of the victim via their IP address.

So far, malware researchers have spotted one main infection vector used in the propagation of the Valak threat – spam emails. The emails in question would claim to come from a reputable source, likely posing as a message sent by the employers of the victim. The fraudulent message would insist that the user needs to open and review the attached file, which is masked as a harmless document that contains important information. However, the attachment it macro-laced and is designed to exploit a known vulnerability in the Microsoft Office suite. This vulnerability would allow the Valak threat to be installed on the targeted computer.

Since the Valak threat is designed to operate silently, its victims may not notice that there is an issue with their systems until it is too late. If you want to avoid falling victim to a threat like the Valak malware, make sure your PC is shielded with a trustworthy, up-to-date anti-malware application.