Keypoints :

• The ValleyRAT malware utilizes sophisticated methods to evade detection and maintain persistence.
• A stolen code-signing certificate is used to sign its components, avoiding security mechanisms.
• Integration of the open-source rootkit Nidhogg allows for deeper control and evasion techniques.
• The malware disables Windows Defender by adding exclusions and can interrupt antivirus processes.
• It creates scheduled tasks to ensure its payloads run with elevated privileges.