Beware of fake Microsoft Teams installation files
Beware of fake Microsoft Teams installation files. Download and get ValleyRAT malware instead.
Although the era of work-from-home or work-from-home gradually deteriorated after the end of the COVID era, teleconferencing applications like Microsoft Teams are still popular because many business activities are still easily possible, and that has become one of the most often impersonated applications to release malware, as in this news.
According to a report by the website, The Hacker News has mentioned the detection of a new campaign of hackers. Silver Fox, a group of hackers of unknown origin, has made a campaign to lure attackers into believing that they have been attacked by Russian hackers through the ValleyRAT (or Winos 4.0) malware release campaign in China by drugging searches through the Search Engine or SEO Poisoning to victims who are searching to download popular software like Microsoft Teams to lure victims to fake websites with the option to download the software. The file, which is named in Russian as "MST amsSetup.zip," makes the victim think that the file is from Russia, but in fact That's downloaded from the Alibaba Cloud network, a Chinese service itself.
After downloading and unlocking the file, an installation called "Setup.exe" will be found. This file will be a Microsoft Teams software installation file with the malware embedded. In that installation, the file will scan whether the process has 360 Total Security ("360tray.exe") protection software running, and add the Exclusion List to Microsoft Defender Antivirus to exclude it from being scanned, and then write a malware version of Microsoft Teams to "AppDataLocal" to complete the exclusion process, and then write an additional file. Down to the server as follows
"AppDataLocalProfiler. Jason."
"AppDataRoamingEmbarcaderoGPUCache2 xml."
"AppDataRoamingEmbarcaderoGPUCache xml."
"AppDataRoamingEmbarcaderoAutoRecoverDat dll."
After that step, the malware will load the data from the files "Profiler.json" and "GPUcache.xml," and then run the malware DLL file directly into memory through a process called "rundll32.exe," making it more difficult to detect because it is a genuine process of Windows itself, and then make the server connection to download the last set of malware files (payload).
What makes the research team from ReliaQuest, an artificial intelligence company for anti-cyber intelligence, see the campaign as a False Flag, comes from the fact that in addition to the files downloaded from the Chinese network mentioned above, malware like ValleyRAT (or Winos 4.0) is also malware created by a Chinese hacker network, which was developed from the Gh0st RAT malware, which has the ability to remotely control the victim's machine, smuggle files from the victim's machine, steal sensitive data from the victim's machine. The victim's machine, such as passwords, sends commands to the victim's machine through installed malware, as well as persistence in the victim's target system. Malware in this group is popular among Chinese hacker networks, making an assumption.
# Welcome 2026 # Take care of yourself # Open budget # Includes IT matters # microsoft
