---
title: "#process-hollowing articles | Hashnode"
description: "Explore 2 articles tagged #process-hollowing on Hashnode. Tutorials, guides, and how-tos from the community."
url: "https://hashnode.com/tag/process-hollowing"
---

Tag

# #process-hollowing

2 posts · 0 followers

[Vũ Nhật Lâm](https://hashnode.com/@kami61) · [Sep 3](https://hashnode.com/posts/valleyrat-overwolf-sideload-tax-scam-en/6a98e49391e583fc09efde75)

### [ValleyRAT and the Cost of a Valid Signature: When the Payload Has No Magic Bytes Left to Catch](https://blog.fiscybersec.com/valleyrat-overwolf-sideload-tax-scam-en?utm_source=hashnode&utm_medium=feed)

Summary The victim extracts a ZIP archive and sees exactly one file: 07.30Document details.exe. That file is a genuine Overwolf Ltd executable with a valid digital signature, simply renamed. The other

19 min read · [blog.fiscybersec.com](https://blog.fiscybersec.com/valleyrat-overwolf-sideload-tax-scam-en?utm_source=hashnode&utm_medium=feed)

[Vũ Nhật Lâm](https://hashnode.com/@kami61) · [Jun 23](https://hashnode.com/posts/from-malspam-to-a-fileless-net-loader-abusing-google-doubleclick-and-a-five-stage-evasion-chain/6a39ed204a985dfa4235edf4)

### [From Malspam to a Fileless .NET Loader: Abusing Google DoubleClick and a Five-Stage Evasion Chain](https://blog.fiscybersec.com/from-malspam-to-a-fileless-net-loader-abusing-google-doubleclick-and-a-five-stage-evasion-chain?utm_source=hashnode&utm_medium=feed)

A German-language "purchase order" email with an HTML attachment is the opening move of a five-stage attack chain in which the malicious link routes through ad.doubleclick\[.\]net — a high-reputation Go

13 min read · [blog.fiscybersec.com](https://blog.fiscybersec.com/from-malspam-to-a-fileless-net-loader-abusing-google-doubleclick-and-a-five-stage-evasion-chain?utm_source=hashnode&utm_medium=feed)