ValleyRAT Backdoor Hides in Signed Adware, Bypasses AV via DLL…

The Silver Fox group is distributing the ValleyRAT backdoor — also known as Winos 4.0 — packaged inside QN Wallpaper, a legitimate, digitally signed Chinese adware. Documented by Kaspersky in research published August 31, 2026, the attack combines DLL sideloading of a malicious libcef.dll with social engineering that tricks victims into adding the software to antivirus exclusions. The compromise stems from explicit user-granted trust, not an exploitable vulnerability.

The Silver Fox group is distributing the ValleyRAT backdoor, also known as Winos 4.0, packaged inside QN Wallpaper, a legitimate, digitally signed Chinese adware. The attack, documented by Kaspersky in research published August 31, 2026, exploits two levers simultaneously: DLL sideloading to execute malicious code in the context of an apparently trustworthy process, and social engineering to induce victims to add the software to antivirus exclusions. The result is a compromise born from explicit user-granted trust, not from a technically exploitable vulnerability.

The technique is a consolidated part of the Silver Fox toolkit. Roughly five weeks before the QN Wallpaper campaign, Cato Networks had already documented the same DLL sideloading infrastructure against a Japanese manufacturer. Kaspersky has also tracked Silver Fox in a previous tax-themed campaign targeting organizations in India and Russia. The research is based on a single installer submitted by a customer, which limits visibility into the exact scale of the QN Wallpaper campaign, but not the technical soundness of the analysis.

Key Takeaways

Silver Fox distributes ValleyRAT disguised as QN Wallpaper, digitally signed Chinese adware, using a malicious libcef.dll DLL sideloading mechanism
The installer disables Windows Defender via the DisableAntiSpyware registry key and adds the program to autorun, then relaunches with runas if the user lacks admin privileges
ValleyRAT marks its own process as critical to trigger BSOD on termination, captures keystrokes and clipboard via DirectInput8, and can inject into svchost using a PAGE_NOACCESS memory technique
Kaspersky detected over 100,000 ValleyRAT detections in 2026 across more than 1,500 unique users, primarily in China and India; the figure covers total annual activity, not just this campaign

How the Installation Works: An Installer That Changes Behavior Based on Its Name

The installer analyzed by Kaspersky, MD5 c24e99f9437feacaa63766a3cde3fe3d, is not a monolithic executable: its behavior varies based on the suffix in the filename. FS_SETUP_DD_173.exe installs DingTalk, a Chinese collaboration app, while FS_SETUP_HY_173.exe opens meeting.tencent.com as a decoy. This flexibility suggests a modular distribution infrastructure capable of adapting the front-end to the victim's context.

Files are extracted to C:\Program Files\QNWallpaper\5.4.0.1662\<random string>, a path that mimics the legitimate QN Wallpaper installation in version 5.4.0.1662. Among the extracted files is QnWallpaper.exe, signed and apparently benign, which has dependencies on libcef.dll — the Chromium Embedded Framework. The legitimate library version is replaced with a malicious module, MD5 07ddbbe2c71c45577a7a4fbcdba0df91, which the signed process automatically loads from the same directory. This is DLL sideloading: no vulnerability exploit, but abuse of a dynamic loading feature designed into the operating system.

The malicious libcef.dll contains a RunDLL function that QnWallpaper.exe does not invoke. Likely intended for manual invocation via rundll32, this function represents a residual option for the attacker: a second entry point into the system that remains available even if the main flow is interrupted. Additionally, the installer writes the DisableAntiSpyware registry key to disable Windows Defender and adds the program to autorun. If the user lacks elevated privileges, the malware relaunches itself with runas to obtain them.

ValleyRAT's Persistence: When Process Termination Destroys the System

ValleyRAT does not merely install itself; it protects itself. The backdoor's configuration is obfuscated with a simple but effective technique: strings are written in reverse. Decoded, the keys reveal a precise control architecture: dd regulates initial sleep time, cl the delay after command execution, bh enables marking the process as critical with consequent BSOD on termination, ll checks for security tools, sh manages injection into svchost.exe.

Injection into svchost is particularly insidious. The malware allocates memory with PAGE_NOACCESS permissions, making the code invisible to scans that read memory regions. It waits 60 seconds, then changes permissions to executable and resumes the thread. If the backdoor is interrupted, this mechanism acts as a dead man's switch: the host process reactivates autonomously. Data capture occurs via DirectInput8 for keystrokes and the active window, plus the clipboard. Kaspersky also confirmed screenshot capability and additional module download.

The identified additional component, MD5 8a626d844943da3456b044f38deae3a2, completes the arsenal. Command-and-control servers identified are 103.45.66.18 on ports 441, 442, and 443, and 192.253.225.173 on ports 6666 and 8888. The port distribution suggests redundant infrastructure, with protocols mimicking HTTPS traffic to evade network filters.

"This case is a clear example of how adware and affiliate networks can turn out to be far more dangerous than they appear. ValleyRAT is a sophisticated backdoor capable of collecting sensitive data such as keystrokes and clipboard contents, taking screenshots, and delivering additional malicious modules." — Kaspersky, via The Hacker News

The Digital Signature Illusion: Why Trust in the Executable Does Not Protect Against Loaded Libraries

The technical core of the attack is a paradox of the Windows security model: the digital signature of QnWallpaper.exe is valid, the certificate is issued to a real vendor, the executable has not been modified. Yet it executes arbitrary code. The file-reputation-based trust system — the foundation of AppLocker, many antivirus products, and user perception — fails because it does not recursively verify all dynamic dependencies loaded at runtime. The malicious libcef.dll resides in the same directory as the executable; Windows prefers it over the system version, and the signed process loads it without alarms.

This is not a bug. It is documented operating system behavior that prioritizes local libraries for application compatibility. Attackers know this and exploit it systematically. Silver Fox in particular has demonstrated mastery of this technique in at least two distinct campaigns, spaced roughly five weeks apart, against targets in East Asia. The digital signature is therefore not an absolute security indicator, but an element of a trust architecture that can be segmented and bypassed.

The nature of QN Wallpaper — legitimate adware with bundled applications and advertising banners — adds another layer of plausibility. Advertising features remain inert during the analyzed infection chain, but their reuse as a wrapper is functional: the user expects invasive behavior, permission requests, system modifications. The malware hides in the shadow of behavior that is already annoying but socially accepted.

What to Do Now

Review antivirus exclusion policies: every manual addition must go through an approval workflow with vendor and purpose verification, not be delegated to the end user
Inspect existing exclusion lists for third-party software with ambiguous reputation, particularly adware and desktop customization utilities, even if signed
Monitor DLL loads from non-standard paths with tools that verify library hash consistency against the vendor's official catalog, not just the parent process signature
Check for the presence of the DisableAntiSpyware registry key and autorun entries pointing to paths with random strings under Program Files, a pattern compatible with the QN Wallpaper installer

The Exclusion Problem: When User Convenience Becomes an Attack Privilege

The distinctive element of this campaign is not technical, but organizational. Attackers know that users, frustrated by antivirus false positives, voluntarily add software to exclusions. Kaspersky documents this explicitly: instructions distributed with the adware or found on forums guide the user to exclude QnWallpaper.exe from scans. This is operational social engineering, not theoretical: the user becomes the vehicle of their own compromise, with an action the security system records as explicit intent.

The consequence is a systemic attack surface. Exclusion lists are traditionally managed as conveniences, not risks. The ValleyRAT case demonstrates they must be treated as high-impact privileges: every exclusion is a potential bypass of the defense barrier, and its granting must be auditable, temporary, and justified. The digital signature of the excluded software does not mitigate this risk, because DLL sideloading bypasses monolithic trust logic.

The geographic distribution — China and India as primary areas of the over 100,000 detections in 2026 — does not limit the case's relevance. Adware infrastructures, affiliate networks that monetize installation traffic, and utility software distribution platforms are global. The attack model is portable to any market where users actively install customization software and are accustomed to interacting with security settings to make it work.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter