Huntress Analyzes Valak JScript Malware and Its Command-and-Control Mechanisms

Summary

Huntress analyzed a JScript sample identified in the community as Valak, tracing registry-loaded code, C2 endpoint generation and task execution. The sample polls multiple C2 domains for commands.

Key points

The explorer.js JScript sample contains C2 domains without obfuscation; the article says the list includes both fake and legitimate domains.
The malware reads a Windows Registry value and appears to execute its contents as additional JavaScript using eval.
The code builds potential C2 endpoints using a 12-character nonce, a rotation cipher, and Base64 encoding.
The sample sends HTTP requests to each C2 server, decodes responses, and checks for a --TASK marker before extracting commands.
The analysis suggests the malware uses WMI and scheduled tasks to run commands; a separate plugin function executes a command through a .bin file in TEMP.
The authors say polling multiple domains could let the malware continue operating if one domain is discovered and replaced.

Article Details

Attack Vectors: The Valak sample is JScript that reads code from a pre-planted Windows Registry value and evaluates it.
The malware polls multiple C2 servers over HTTP for tasks, decodes responses, and executes received commands.
The malware prepares commands for execution through WMI and a scheduled task; it also uses WMI to execute commands without a scheduled task.
The article reports that a pre-existing .bin file can act as a beacon and receive a plugin ID.
Defensive Notes: The article recommends adding the listed suspicious C2 URLs to an IOC library or blocking them, while noting that some listed domains may be legitimate.
Use active threat hunting and manual analysis to supplement automated security tools.
Inspect the relevant Registry value and the explorer.js stub when investigating this sample.

Indicators of compromise

Type	Indicator	Context
URL	`hxxp[:]//e4a24fb0e[.]com`	Listed among the sample's C2 servers and suggested for IOC-library inclusion or blocking.
URL	`hxxp[:]//f78efaf43b[.]com`	Listed among the sample's C2 servers and suggested for IOC-library inclusion or blocking.
URL	`hxxp[:]//monsuperentrepreneur[.]com`	Listed among the sample's C2 servers and suggested for IOC-library inclusion or blocking.
URL	`hxxp[:]//tangocation[.]com`	Listed among the sample's C2 servers and suggested for IOC-library inclusion or blocking.
URL	`hxxp[:]//tauhutxiga[.]com`	Listed among the sample's C2 servers and suggested for IOC-library inclusion or blocking.