ValleyRAT and the Cost of a Valid Signature: When the Payload Has No Magic Bytes Left to Catch

Summary The victim extracts a ZIP archive and sees exactly one file: 07.30Document details.exe. That file is a genuine Overwolf Ltd executable with a valid digital signature, simply renamed. The other