ValleyRAT Backdoor Distributed via Signed Adware

The threat actor known as Silver Fox has been observed deploying the ValleyRAT backdoor (also identified as Winos 4.0) by embedding it within a modified, signed version of the QN Wallpaper adware application. By leveraging a legitimately signed executable, the attackers trick users into trusting the application and adding the installation directory to antivirus exclusion lists. This activity enables the malware to operate with reduced interference from endpoint security controls.

The delivery relies on DLL sideloading, where a malicious 'libcef.dll' is planted alongside the legitimate 'QnWallpaper.exe'. Upon execution, the backdoor gains full control over the compromised machine, enabling sensitive data exfiltration - including keystrokes, clipboard contents, and screenshots - as well as the deployment of additional malicious modules. The infection process also attempts to disable Windows Defender and utilizes defensive measures that trigger a system crash if a user attempts to terminate the malicious process. This technique represents a sustained effort by Silver Fox to abuse trust in signed applications for persistent access.

Attack Chain

1. The user executes the malicious installer, which unpacks the legitimate signed 'QnWallpaper.exe' and the malicious 'libcef.dll' into a common directory.
2. The installer modifies the Windows Registry to set 'DisableAntiSpyware' to 1, attempting to neutralize native security protections.
3. The installer creates a persistent entry in the system autorun registry keys to ensure execution upon boot.
4. The installer checks for current process privileges; if non-administrative, it relaunches itself using 'runas' to obtain elevated system access.
5. The signed 'QnWallpaper.exe' process initiates, which inadvertently loads the malicious 'libcef.dll' present in its working directory (DLL Sideloading).
6. The ValleyRAT payload initiates, connects to C2 infrastructure, and monitors for active termination attempts, triggering a system crash if the process is closed.
7. The backdoor enables remote control, allowing the attacker to perform keystroke logging, clipboard harvesting, and data exfiltration.

Impact

The campaign leverages trusted software to gain persistent, elevated access to victim systems. Successfully compromised machines are fully controlled by the threat actor, allowing for the collection of sensitive PII, passwords, and proprietary data. While the specific impact per organization varies, ValleyRAT has been detected in over 1,500 unique environments throughout 2026, primarily affecting users in China and India.

Recommendation

Prioritize the implementation of the following detections and defensive controls:

• Deploy the Sigma rules below to monitor for suspicious DLL loads by signed processes and unauthorized registry modifications.
• Audit existing antivirus and EDR exclusion lists to identify and remove entries pointing to 'C:\Program Files\QNWallpaper' or other suspicious adware locations.
• Restrict the ability of users to add security product exclusions, enforcing these policies via Group Policy or centralized management consoles.
• Block communication to the identified C2 IP addresses (103.45.66.18, 192.253.225.173) at the perimeter firewall.