ValleyRAT backdoor distributed via trojanized QN Wallpaper adware installer using libcef.dll sideloading, likely Silver Fox

Linha do tempo

1. securelist.com ↗ · pub. 31/08/2026 07:00 · coletado 19/10 17:57 primeiro registro

   ValleyRAT backdoor distributed via trojanized QN Wallpaper adware installer using libcef.dll sideloading, likely Silver Fox

   ler a análise desta fonte ocultar

   Kaspersky analysis of an installer first classified as adware (MD5 c24e99f9437feacaa63766a3cde3fe3d) found that it delivers the ValleyRAT backdoor. The installer drops a modified, signed Chinese wallpaper tool, QN Wallpaper, and uses it for DLL sideloading of a malicious libcef.dll. The adware's advertising function does not work. Attackers may have chosen this disguise because the signed adware is often manually added to security exclusion lists. In 2026 the vendor recorded more than 100,000 detections of ValleyRAT and related malware, affecting over 1,500 unique users, mainly in China and India. Based on geography and the malware family, the campaign is likely linked to Silver Fox.

   Technical Details

   • The installer behaves differently depending on a two-letter suffix in the file name, likely to distract the user. It unpacks QN Wallpaper to C:\Program Files\QNWallpaper\5.4.0.1662\<random>, adds it to autorun, and disables Windows Defender via the DisableAntiSpyware registry key.
   • QnWallpaper.exe and QnwPlayer.exe load the malicious libcef.dll. Its exports sleep indefinitely, with a fallback that loads the original library. Malicious code runs from DllMain, and an unused RunDLL export is also present.
   • Persistence is set up through a file extension association and a file dropped in the Startup folder. If the user is not an administrator, the malware relaunches itself with runas.
   • The payload depends on the host process. In QnWallpaper.exe it is read from the PeLoader file; in QnwPlayer.exe it comes from libcef.dll resources. Both are AES-encrypted DLLs containing ValleyRAT and differ only in their C2 configuration. PE headers are validated after decryption.
   • The ValleyRAT configuration is a reversed string of key:value pairs. Configurable protections include injecting a restart function into svchost (memory set to PAGE_NOACCESS, then RWX after a 60-second delay) and marking the process as critical so that killing it causes a BSOD. Restart on unhandled exceptions is always active.
   • Spyware functions include keylogging and focused-window tracking via DirectInput8, clipboard capture, and logging to disk. If the ll key is set to 1, it enumerates windows to detect analysis tools. It also collects Windows version details, the focused window title and the system directory path.
   • Commands cover shutdown, C2 address updates, module download and execution, and exfiltration of keylogger and clipboard logs. Modules are DLLs, loaded in-process with DllMain and Main called, or shellcode launched through process hollowing in svchost.
   • Network indicators: 103.45.66.18 (ports 441-443) and 192.253.225.173 (ports 6666, 8888).

   Remediation

   • Enforce policies on third-party software on work devices and keep employee awareness training current.
   • Do not install software of questionable reputation, and never add such software to security solution exclusion lists.
   • Hunt for the listed hashes, the QNWallpaper directory, libcef.dll sideloading by QnWallpaper.exe/QnwPlayer.exe, DisableAntiSpyware changes and the listed C2 IPs.