Valak

ATP Sandbox Adv. Heuristics

Stats

First seen: June 2022
Last seen: October 2026

MITRE ATT&CK techniques

34 techniques across 9 tactics.

TA0001 Initial Access

T1566Phishing
- T1566.001Spearphishing Attachment
- T1566.002Spearphishing Link

TA0002 Execution

T1047Windows Management Instrumentation
T1053Scheduled Task/Job
- T1053.005Scheduled Task
T1059Command and Scripting Interpreter
- T1059.007JavaScript
- T1059.001PowerShell
T1204User Execution
- T1204.002Malicious File
T1559Inter-Process Communication
- T1559.002Dynamic Data Exchange

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.002Software Packing
- T1027.011Fileless Storage
T1140Deobfuscate/Decode Files or Information
T1218System Binary Proxy Execution
- T1218.010Regsvr32
T1564Hide Artifacts
- T1564.004NTFS File Attributes

TA0006 Credential Access

T1552Unsecured Credentials
- T1552.002Credentials in Registry
T1555Credentials from Password Stores
- T1555.004Windows Credential Manager

TA0007 Discovery

T1012Query Registry
T1016System Network Configuration Discovery
T1033System Owner/User Discovery
T1057Process Discovery
T1082System Information Discovery
T1087Account Discovery
- T1087.002Domain Account
- T1087.001Local Account
T1518Software Discovery
- T1518.001Security Software Discovery

TA0009 Collection

T1113Screen Capture
T1114Email Collection
- T1114.002Remote Email Collection
T1119Automated Collection

TA0011 Command and Control

T1008Fallback Channels
T1071Application Layer Protocol
- T1071.001Web Protocols
T1104Multi-Stage Channels
T1105Ingress Tool Transfer
T1132Data Encoding
- T1132.001Standard Encoding

TA0010 Exfiltration

T1041Exfiltration Over C2 Channel

TA0112 Defense Impairment

T1112Modify Registry

Associated groups

G0127TA551

Alert name variants

Alert Name	Engine
Document-Word.Downloader.Valak	ATP Sandbox Adv. Heuristics
Document-Word.Trojan.Valak	ATP Sandbox Adv. Heuristics
Script-JS.Trojan.Valak	ATP Sandbox Adv. Heuristics
Script-Macro.Trojan.Valak	ATP Sandbox Adv. Heuristics
Win32.Spyware.Valak	ATP Sandbox Adv. Heuristics
Win32.Trojan.Valak	ATP Sandbox Adv. Heuristics

Related families

QakBot Latrodectus TrickBot Bazar InvisiMole