LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0476: Valak

Valak is a multi-stage modular malware that can function as a standalone information stealer or downloader, first observed in 2019 targeting enterprises in the US and Germany.[1][2]

EnterpriseS0476MalwareObject v1.3Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Automated summary not available

Glexia publishes ATT&CK takes only after source-hash and schema validation. Until then, use the official MITRE definition below and the defensive relationship context on this page.

Official MITRE ATT&CK definition

Valak

Valak is a multi-stage modular malware that can function as a standalone information stealer or downloader, first observed in 2019 targeting enterprises in the US and Germany.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

34 rows
DomainIDNameRelationship / procedure
EnterpriseT1112Modify Registry

Valak has the ability to modify the Registry key HKCU\Software\ApplicationContainer\Appsw64 to store information regarding the C2 server and downloads.[1][2]CitationSentinelOne Valak June 2020

EnterpriseT1555.004Windows Credential ManagerSub-technique

Valak can use a .NET compiled module named exchgrabber to enumerate credentials from the Credential Manager.CitationSentinelOne Valak June 2020

EnterpriseT1057Process Discovery

Valak has the ability to enumerate running processes on a compromised host.[1]

EnterpriseT1564.004NTFS File AttributesSub-technique

Valak has the ability save and execute files as alternate data streams (ADS).[1][2]CitationSentinelOne Valak June 2020

EnterpriseT1027Obfuscated Files or Information

Valak has the ability to base64 encode and XOR encrypt strings.[1][2]CitationSentinelOne Valak June 2020

EnterpriseT1218.010Regsvr32Sub-technique

Valak has used regsvr32.exe to launch malicious DLLs.[1][2]

EnterpriseT1071.001Web ProtocolsSub-technique

Valak has used HTTP in communications with C2.[1][2]

EnterpriseT1104Multi-Stage Channels

Valak can download additional modules and malware capable of using separate C2 channels.[2]

EnterpriseT1008Fallback Channels

Valak can communicate over multiple C2 hosts.[2]

EnterpriseT1518.001Security Software DiscoverySub-technique

Valak can determine if a compromised host has security products installed.[1]

EnterpriseT1204.002Malicious FileSub-technique

Valak has been executed via Microsoft Word documents containing malicious macros.[1][2]CitationSentinelOne Valak June 2020

EnterpriseT1113Screen Capture

Valak has the ability to take screenshots on a compromised host.[1]

EnterpriseT1033System Owner/User Discovery

Valak can gather information regarding the user.[1]

EnterpriseT1559.002Dynamic Data ExchangeSub-technique

Valak can execute tasks via OLE.CitationSentinelOne Valak June 2020

EnterpriseT1059.007JavaScriptSub-technique

Valak can execute JavaScript containing configuration data for establishing persistence.[1]

EnterpriseT1082System Information Discovery

Valak can determine the Windows version and computer name on a compromised host.[1]CitationSentinelOne Valak June 2020

EnterpriseT1566.001Spearphishing AttachmentSub-technique

Valak has been delivered via spearphishing e-mails with password protected ZIP files.[2]

EnterpriseT1119Automated Collection

Valak can download a module to search for and build a report of harvested credential data.CitationSentinelOne Valak June 2020

EnterpriseT1105Ingress Tool Transfer

Valak has downloaded a variety of modules and payloads to the compromised host, including IcedID and NetSupport Manager RAT-based malware.[2][1]

EnterpriseT1041Exfiltration Over C2 Channel

Valak has the ability to exfiltrate data over the C2 channel.[1][2]CitationSentinelOne Valak June 2020

EnterpriseT1552.002Credentials in RegistrySub-technique

Valak can use the clientgrabber module to steal e-mail credentials from the Registry.CitationSentinelOne Valak June 2020

EnterpriseT1016System Network Configuration Discovery

Valak has the ability to identify the domain and the MAC and IP addresses of an infected machine.[1]

EnterpriseT1114.002Remote Email CollectionSub-technique

Valak can collect sensitive mailing information from Exchange servers, including credentials and the domain certificate of an enterprise.[1]

EnterpriseT1027.002Software PackingSub-technique

Valak has used packed DLL payloads.CitationSentinelOne Valak June 2020

EnterpriseT1027.011Fileless StorageSub-technique

Valak has the ability to store information regarding the C2 server and downloads in the Registry key HKCU\Software\ApplicationContainer\Appsw64.[1][2]CitationSentinelOne Valak June 2020

EnterpriseT1012Query Registry

Valak can use the Registry for code updates and to collect credentials.[2]

EnterpriseT1053.005Scheduled TaskSub-technique

Valak has used scheduled tasks to execute additional payloads and to gain persistence on a compromised host.[1][2]CitationSentinelOne Valak June 2020

EnterpriseT1140Deobfuscate/Decode Files or Information

Valak has the ability to decode and decrypt downloaded files.[1][2]

EnterpriseT1132.001Standard EncodingSub-technique

Valak has returned C2 data as encoded ASCII.[2]

EnterpriseT1087.002Domain AccountSub-technique

Valak has the ability to enumerate domain admin accounts.[1]

EnterpriseT1087.001Local AccountSub-technique

Valak has the ability to enumerate local admin accounts.[1]

EnterpriseT1059.001PowerShellSub-technique

Valak has used PowerShell to download additional modules.[1]

EnterpriseT1047Windows Management Instrumentation

Valak can use wmic process call create in a scheduled task to launch plugins and for execution.CitationSentinelOne Valak June 2020

EnterpriseT1566.002Spearphishing LinkSub-technique

Valak has been delivered via malicious links in e-mail.CitationSentinelOne Valak June 2020

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0127: TA551

TA551 is a financially-motivated threat group that has been active since at least 2018. [1] The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns. [2]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1112: Modify RegistryEnterpriseuses · TechniqueT1555.004: Windows Credential ManagerEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1564.004: NTFS File AttributesEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1218.010: Regsvr32Enterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1104: Multi-Stage ChannelsEnterpriseuses · TechniqueT1008: Fallback ChannelsEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1559.002: Dynamic Data ExchangeEnterpriseuses · TechniqueT1059.007: JavaScriptEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1119: Automated CollectionEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1552.002: Credentials in RegistryEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1114.002: Remote Email CollectionEnterpriseuses · TechniqueT1027.002: Software PackingEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
20.0
Object version
1.3
Created
Modified
Raw hash
a6dcffdbba5388a8...
Imported snapshots across ATT&CK releases(3)
ReleaseBundle importedObject versionModifiedStatusRaw hash
20.01.3Current bundlea6dcffdbba53…
19.21.3Older bundlea6dcffdbba53…
19.11.3Older bundlea6dcffdbba53…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Cybereason Valak May 2020

    Salem, E. et al. (2020, May 28). VALAK: MORE THAN MEETS THE EYE . Retrieved June 19, 2020.

    Open source URL
  2. [2]
    Unit 42 Valak July 2020

    Duncan, B. (2020, July 24). Evolution of Valak, from Its Beginnings to Mass Distribution. Retrieved August 31, 2020.

    Open source URL
  3. [3]
    mitre-attackS0476
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use