AI Security AI安全 4h ago Updated 2h ago 更新于 2小时前 43

ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions ValleyRAT后门隐藏在用户添加到杀毒软件排除项的签名广告软件中

Silver Fox threat actor distributes ValleyRAT backdoor disguised as signed Chinese adware (QN Wallpaper), using DLL sideloading to execute malicious code under a trusted, signed process The attack disables Windows Defender via the DisableAntiSpyware registry key, adds itself to autorun, and uses runas to escalate privileges when admin rights are absent ValleyRAT can flag its own process as critical, causing a blue screen of death if termination is attempted, and collects keystrokes, clipboard da Silver Fox攻击者利用DLL旁加载技术,将ValleyRAT后门伪装成签名的中国广告软件QN Wallpaper,绕过用户添加到杀毒软件排除列表的信任机制 恶意软件通过修改libcef.dll实现进程注入,在合法签名进程内运行以规避安全检测,并具备键盘记录、剪贴板窃取、截图和模块加载能力 攻击者通过注册表禁用Windows Defender、添加自启动项,并将自身进程标记为critical以阻止终止(终止会触发蓝屏) 2026年Kaspersky记录超过10万次ValleyRAT检测,影响1500+用户,主要集中在中国和印度地区 安全厂商建议用户避免安装声誉可疑的软件,并严禁将其添加到

65
Hot 热度
65
Quality 质量
55
Impact 影响力

Analysis 深度分析

TL;DR

  • Silver Fox threat actor distributes ValleyRAT backdoor disguised as signed Chinese adware (QN Wallpaper), using DLL sideloading to execute malicious code under a trusted, signed process
  • The attack disables Windows Defender via the DisableAntiSpyware registry key, adds itself to autorun, and uses runas to escalate privileges when admin rights are absent
  • ValleyRAT can flag its own process as critical, causing a blue screen of death if termination is attempted, and collects keystrokes, clipboard data, screenshots, and delivers additional malicious modules
  • The campaign leverages antivirus exclusions by disguising malware as legitimate adware that users are likely to whitelist, significantly reducing detection likelihood
  • Kaspersky recorded over 100,000 ValleyRAT detections across 2026 affecting 1,500+ unique users, primarily in China and India

Why It Matters

This attack demonstrates a sophisticated social engineering and technical combination that exploits user trust in signed software and antivirus exclusion lists, making it a critical case study for understanding how threat actors bypass security controls. For AI and security practitioners, it highlights the growing convergence of adware ecosystems and targeted malware distribution, requiring updated detection strategies and user education approaches.

Technical Details

  • DLL Sideloading Attack: The installer unpacks a modified copy of QN Wallpaper and runs the signed executable QnWallpaper.exe, which loads a malicious libcef.dll planted in the same directory, allowing the backdoor to execute within a legitimately signed process and bypass signature-based trust controls
  • Persistence and Evasion Mechanisms: The malware disables Windows Defender via the DisableAntiSpyware registry key, establishes autorun persistence, and uses runas to escalate privileges when the logged-in user lacks administrator rights
  • Anti-Termination Defense: ValleyRAT can flag its own process as critical, triggering a blue screen of death if any attempt is made to terminate it, effectively preventing manual remediation
  • Capabilities: The backdoor provides full machine control including keystroke logging, clipboard interception, screenshot capture, and the ability to deliver additional malicious modules
  • Infrastructure and IoCs: C2 servers at 103.45.66.18 (ports 441, 442, 443) and 192.253.225.173 (ports 6666, 8888); domains include qnwallpaper.keansoft.cn and decoy meeting.tencent.com; MD5 hashes provided for the installer and malicious DLL

Industry Insight

  • Organizations should enforce strict policies prohibiting the addition of third-party or questionable software to antivirus exclusion lists, as this campaign specifically exploits this behavior to achieve persistent, undetected access
  • Security teams should monitor for DLL sideloading patterns involving signed executables from legitimate but adware-associated applications, particularly in the Chinese software ecosystem, as this is an established Silver Fox technique
  • The convergence of adware distribution networks and targeted backdoor delivery represents an evolving threat vector; vendors and enterprises should treat adware not merely as a nuisance but as a potential initial access vector for sophisticated malware campaigns

TL;DR

  • Silver Fox攻击者利用DLL旁加载技术,将ValleyRAT后门伪装成签名的中国广告软件QN Wallpaper,绕过用户添加到杀毒软件排除列表的信任机制
  • 恶意软件通过修改libcef.dll实现进程注入,在合法签名进程内运行以规避安全检测,并具备键盘记录、剪贴板窃取、截图和模块加载能力
  • 攻击者通过注册表禁用Windows Defender、添加自启动项,并将自身进程标记为critical以阻止终止(终止会触发蓝屏)
  • 2026年Kaspersky记录超过10万次ValleyRAT检测,影响1500+用户,主要集中在中国和印度地区
  • 安全厂商建议用户避免安装声誉可疑的软件,并严禁将其添加到安全工具的排除列表

为什么值得看

本文揭示了攻击者如何利用"合法签名+用户主动排除"的组合策略绕过企业安全防御,为安全从业者提供了DLL旁加载攻击的最新实战案例。该威胁展示了广告软件生态如何被武器化,对Endpoint安全策略和第三方软件管理具有直接指导意义。

技术解析

  • DLL旁加载攻击链:攻击者打包修改版的QN Wallpaper,将恶意libcef.dll植入同目录,当用户运行签名可执行文件QnWallpaper.exe时,系统优先加载恶意DLL,使后门在合法签名进程内执行
  • 持久化与防御规避:通过DisableAntiSpyware注册表键禁用Windows Defender,添加自启动项,使用runas提权;关键特性是将自身进程标记为critical,终止操作会触发BSOD
  • C2通信与IoC:命令控制服务器位于103.45.66.18(端口441/442/443)和192.253.225.173(端口6666/8888),分发域名qnwallpaper.keansoft.cn,并使用meeting.tencent.com作为诱饵页面
  • 检测规模:2026年累计超过10万次ValleyRAT相关检测,覆盖1500+独立用户,攻击者Silver Fox此前已有利用DLL旁加载针对日本制造商的攻击记录

行业启示

  • 排除列表风险管控:企业应严格审查杀毒软件排除列表,禁止将非白名单软件或可疑应用加入排除项,这是本次攻击成功的关键因素
  • 第三方软件治理:建立严格的第三方软件安装政策,对广告软件、破解工具等高风险类别实施默认阻断,员工安全意识培训需强调"签名不等于安全"
  • 进程行为监控:安全运营应关注critical进程标记、异常DLL加载路径和注册表修改行为,建立针对DLL旁加载的检测规则以弥补签名信任机制的缺陷

Disclaimer: The above content is generated by AI and is for reference only. 免责声明:以上内容由 AI 生成,仅供参考。

Security 安全 Research 科学研究