Full Report
The threat actor known as Silver Fox has been observed distributing the ValleyRAT backdoor disguised as a signed Chinese adware application, running the malware under a trusted process to slip past users who add such software to their antivirus exclusions. Russian cybersecurity vendor Kaspersky said the attackers built the disguise around QN Wallpaper, a genuine Chinese desktop-wallpaper tool
Analysis Summary
# Tool/Technique: ValleyRAT (aka Winos 4.0)
## Overview
ValleyRAT is a sophisticated multi-stage backdoor used primarily for espionage and remote system control. In this specific campaign, it is distributed via a Trojanized version of **QN Wallpaper**, a legitimate but "questionable" Chinese adware application. The primary purpose of this technique is to leverage the "trusted" status of signed adware—which users often manually add to antivirus exclusion lists—to bypass endpoint security controls.
## Technical Details
- **Type:** Malware family (Backdoor)
- **Platform:** Windows
- **Capabilities:** Remote access, data exfiltration, DLL sideloading, defense evasion.
- **First Seen:** Variant reported in August 2026 (related loaders seen as early as 2025).
## MITRE ATT&CK Mapping
- **[TA0002 - Execution]**
- [T1204.002 - User Execution: Malicious File]
- **[TA0003 - Persistence]**
- [T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder]
- **[TA0004 - Privilege Escalation]**
- [T1548.002 - Abuse Elevation Control Mechanism: Bypass User Account Control (via `runas`)]
- **[TA0005 - Defense Evasion]**
- [T1574.002 - Hijack Execution Flow: DLL Side-Loading]
- [T1562.001 - Impair Defenses: Disable or Modify Tools (Registry modifications)]
- **[TA0009 - Collection]**
- [T1056.001 - Input Capture: Keylogging]
- [T1115 - Clipboard Data]
- [T1113 - Screen Capture]
## Functionality
### Core Capabilities
- **Full Remote Control:** Provides the operator total command over the compromised machine.
- **Data Exfiltration:** Capable of capturing keystrokes (keylogging), harvesting clipboard contents, and taking screenshots.
- **Modular Architecture:** Can deliver and execute additional malicious modules based on attacker needs.
### Advanced Features
- **DLL Sideloading:** Uses a signed executable (`QnWallpaper.exe`) to load a malicious library (`libcef.dll`), masking malicious activity within a trusted process.
- **Self-Protection:** Flags its own process as "critical," ensuring that if the process is terminated, the system triggers a Blue Screen of Death (BSOD).
- **Automated Defense Evasion:** The installer automatically modifies the Windows Registry to disable Windows Defender (`DisableAntiSpyware`).
## Indicators of Compromise
- **File Hashes (MD5):**
- `c24e99f9437feacaa63766a3cde3fe3d` (Installer)
- `07ddbbe2c71c45577a7a4fbcdba0df91` (Malicious `libcef.dll`)
- `8a626d844943da3456b044f38deae3a2` (Additional payload)
- **File Names:** `QnWallpaper.exe`, `libcef.dll`
- **Registry Keys:** `HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware`
- **Network Indicators:**
- 103[.]45[.]66[.]18 (Ports: 441, 442, 443)
- 192[.]253[.]225[.]173 (Ports: 6666, 8888)
- qnwallpaper[.]keansoft[.]cn (Malicious download domain)
- meeting[.]tencent[.]com (Legitimate decoy domain)
- **Behavioral Indicators:** Installation directory `C:\Program Files\QNWallpaper\5.4.0.1662\`, use of `runas` for privilege escalation.
## Associated Threat Actors
- **Silver Fox** (Also known for tax-themed campaigns and targeting industrial sectors).
## Detection Methods
- **Signature-based detection:** Monitoring for the specific MD5 hashes of the modified `libcef.dll`.
- **Behavioral detection:**
- Monitoring for unauthorized registry changes to `DisableAntiSpyware`.
- Detecting `runas` calls originating from adware-related processes.
- Identifying DLL sideloading events where `QnWallpaper.exe` loads an unsigned or incorrectly signed `libcef.dll`.
## Mitigation Strategies
- **Policy Enforcement:** Establish strict policies against installing third-party software of questionable reputation (adware, wallpaper tools) on work devices.
- **Security Awareness:** Educate users on the risks of adding software to antivirus exclusion lists.
- **Least Privilege:** Restrict administrative rights to prevent the malware from successfully using `runas` to disable system defenses.
- **Endpoint Hardening:** Enable Tamper Protection in Windows Defender to prevent registry-based disabling of security tools.
## Related Tools/Techniques
- **Winos 4.0:** An alternative name/variant of the ValleyRAT backdoor.
- **PNGPlug:** A loader previously used by Silver Fox to deliver ValleyRAT.
- **ABCDoor:** A different malware family previously deployed by Silver Fox in tax-themed campaigns.