Published on August 31, 2026
ValleyRAT Backdoor Hides in Signed Adware That Users Add to Antivirus Exclusions
Severity
Medium
Detail
Kaspersky researchers have identified a campaign attributed to the China-linked threat actor Silver Fox, distributing the ValleyRAT backdoor, also tracked as Winos 4.0, disguised as a legitimate signed Chinese adware application. The attackers modified QN Wallpaper, a genuine Chinese desktop-wallpaper application that normally displays advertisements and bundles partner software. The malicious version abuses the application’s trusted digital signature and uses DLL sideloading to execute ValleyRAT within a legitimate signed process.
Once installed, ValleyRAT provides attackers with extensive control over compromised systems, including the ability to capture keystrokes and clipboard contents, take screenshots, and deploy additional malicious modules. The campaign is particularly concerning because users may add the seemingly legitimate application to antivirus exclusion lists, allowing the malicious components to operate with reduced security scrutiny.
How?
Silver Fox distributes a modified QN Wallpaper installer containing a legitimate signed executable, QnWallpaper[.]exe, and a malicious libcef[.]dll. When the signed executable launches, it sideloads the malicious DLL, causing ValleyRAT to execute under a trusted process.
Before launching the adware component, the installer attempts to disable Windows Defender using the DisableAntiSpyware registry value and establishes persistence through Windows autorun entries. If the malware is executed without administrator privileges, it relaunches itself using runas to obtain elevated privileges. ValleyRAT can also mark its process as critical, meaning attempts to terminate the process may trigger a Windows system crash (BSOD).
The backdoor then establishes communication with attacker-controlled infrastructure and provides capabilities for credential and data collection, keylogging, clipboard monitoring, screenshot capture, and deployment of additional malicious components.
Indicator of Compromises (IoCs)
The table below shows a selection of IoCs associated with ValleyRAT malicious activity.
| Type | Indicator | Description |
| MD5 | c24e99f9437feacaa63766a3cde3fe3d | Submitted malicious installer |
| MD5 | 07ddbbe2c71c45577a7a4fbcdba0df91 | Malicious libcef[.]dll |
| MD5 | 8a626d844943da3456b044f38deae3a2 | ValleyRAT-related file |
| IPv4 | 103[.]45[.]66[.]18 | C2 infrastructure; ports 441, 442 and 443 |
| IPv4 | 192[.]253[.]225[.]173 | C2 infrastructure; ports 6666 and 8888 |
| Domain | qnwallpaper[.]keansoft[.]cn | Abused adware download site |
| Domain | meeting[.]tencent[.]com | Legitimate decoy page opened during infection |
Conclusion
The ValleyRAT campaign demonstrates how legitimate signed applications and adware distribution channels can be weaponized to bypass endpoint security controls. By executing malicious code through a trusted QN Wallpaper process, Silver Fox can make the infection appear legitimate while gaining extensive control over the victim’s system.
The campaign also highlights the danger of users adding questionable third-party applications to antivirus exclusion lists, as such exclusions can provide attackers with an opportunity to operate with reduced security visibility.
Source
https://thehackernews.com/2026/08/valleyrat-backdoor-hides-in-signed.html