ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions
Silver Fox threat actor distributes ValleyRAT backdoor disguised as signed Chinese adware (QN Wallpaper), using DLL sideloading to execute malicious code under a trusted, signed process The attack disables Windows Defender via the DisableAntiSpyware registry key, adds itself to autorun, and uses runas to escalate privileges when admin rights are absent ValleyRAT can flag its own process as critical, causing a blue screen of death if termination is attempted, and collects keystrokes, clipboard da
Analysis
TL;DR
- Silver Fox threat actor distributes ValleyRAT backdoor disguised as signed Chinese adware (QN Wallpaper), using DLL sideloading to execute malicious code under a trusted, signed process
- The attack disables Windows Defender via the DisableAntiSpyware registry key, adds itself to autorun, and uses runas to escalate privileges when admin rights are absent
- ValleyRAT can flag its own process as critical, causing a blue screen of death if termination is attempted, and collects keystrokes, clipboard data, screenshots, and delivers additional malicious modules
- The campaign leverages antivirus exclusions by disguising malware as legitimate adware that users are likely to whitelist, significantly reducing detection likelihood
- Kaspersky recorded over 100,000 ValleyRAT detections across 2026 affecting 1,500+ unique users, primarily in China and India
Why It Matters
This attack demonstrates a sophisticated social engineering and technical combination that exploits user trust in signed software and antivirus exclusion lists, making it a critical case study for understanding how threat actors bypass security controls. For AI and security practitioners, it highlights the growing convergence of adware ecosystems and targeted malware distribution, requiring updated detection strategies and user education approaches.
Technical Details
- DLL Sideloading Attack: The installer unpacks a modified copy of QN Wallpaper and runs the signed executable
QnWallpaper.exe, which loads a maliciouslibcef.dllplanted in the same directory, allowing the backdoor to execute within a legitimately signed process and bypass signature-based trust controls - Persistence and Evasion Mechanisms: The malware disables Windows Defender via the
DisableAntiSpywareregistry key, establishes autorun persistence, and usesrunasto escalate privileges when the logged-in user lacks administrator rights - Anti-Termination Defense: ValleyRAT can flag its own process as critical, triggering a blue screen of death if any attempt is made to terminate it, effectively preventing manual remediation
- Capabilities: The backdoor provides full machine control including keystroke logging, clipboard interception, screenshot capture, and the ability to deliver additional malicious modules
- Infrastructure and IoCs: C2 servers at
103.45.66.18(ports 441, 442, 443) and192.253.225.173(ports 6666, 8888); domains includeqnwallpaper.keansoft.cnand decoymeeting.tencent.com; MD5 hashes provided for the installer and malicious DLL
Industry Insight
- Organizations should enforce strict policies prohibiting the addition of third-party or questionable software to antivirus exclusion lists, as this campaign specifically exploits this behavior to achieve persistent, undetected access
- Security teams should monitor for DLL sideloading patterns involving signed executables from legitimate but adware-associated applications, particularly in the Chinese software ecosystem, as this is an established Silver Fox technique
- The convergence of adware distribution networks and targeted backdoor delivery represents an evolving threat vector; vendors and enterprises should treat adware not merely as a nuisance but as a potential initial access vector for sophisticated malware campaigns
Disclaimer: The above content is generated by AI and is for reference only.