⚠️ Overview

ValueVault is a Java-based information stealer first documented in December 2024 by the Sekoia TDR team, attributed to a threat actor tracked as TA569 (or Gold Prelude), and categorized as a credential and data thief targeting cryptocurrency wallets and browser-stored credentials.

🔧 Technical Capabilities

ValueVault is distributed via malvertising and SEO-poisoned search results for legitimate software like Cisco AnyConnect, forcing downloads of a Java archive (JAR). It uses a custom C2 protocol over TCP port 24828 with XOR-encrypted payloads and employs reflective code loading to evade static detection. The malware collects browser credentials from Chromium-based browsers, exfiltrates files matching predefined extensions (.txt, .doc, .jpg, .wallet), and specifically targets browser extension wallets—MetaMask, Trust Wallet, and Exodus—by stealing seed phrases from local storage. Persistence is achieved via a Windows registry Run key or scheduled task created by a PowerShell dropper. It uses process hollowing against explorer.exe to disguise its activity and includes anti-VM checks by querying WMI for BIOS and disk serial numbers.

📜 History & Notable Incidents

ValueVault was first discovered in late 2024 by Sekoia, with active campaigns observed through early 2025. Researchers noted it shared code overlaps with the "Vidar" and "Raccoon" stealers, though no unique CVE was assigned. In January 2025, the malware was used in a targeted campaign against users of crypto trading platforms via fake download pages. No high-profile victim names or law enforcement actions have been publicly reported as of early 2025.

🔍 Detection Indicators

Known file hashes are not widely published, but behavioral indicators include creation of a scheduled task named "JavaUpdateChecker" and a registry Run key under "HKCUSoftwareMicrosoftWindowsCurrentVersionRunJavaCache". Network IOCs show outbound connections to IPs in the 185.225.xx.xx range (hosted on AS200312) using a custom User-Agent string like "Mozilla/5.0 (Java; U; Windows 10; en-US) ValueVault/1.0". The malicious JAR file is often named "CiscoSecureClient.jar" or "FakeSoftwareSetup.jar".

☠️ Risk & Impact

ValueVault primarily compromises individual cryptocurrency investors and small businesses, leading to theft of digital wallets, browser-stored passwords, and sensitive documents. Financial losses from stolen cryptocurrency seed phrases can be total and irreversible, with targeted sectors including finance and technology. The malware's stealthy C2 protocol and Java-based nature allow it to bypass many enterprise endpoint detection tools that do not inspect JAR archives.

🛡️ Mitigation

Defenders should block execution of untrusted JAR files via application whitelisting, enable network monitoring for outbound TCP traffic to port 24828, and deploy YARA rules targeting the "ValueVault.class" strings inside JAR archives. Sekoia has published Sigma detection rules for the scheduled task creation and registry persistence. Users should only download software from official sources and use hardware wallets for cryptocurrency storage.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.