Kaspersky Details ValleyRAT Campaign Using Signed QN Wallpaper Adware

Summary

Kaspersky says Silver Fox likely distributed ValleyRAT through signed QN Wallpaper adware, using DLL sideloading to run the backdoor in a trusted process. Its analysis was based on one submitted installer and gave no victim count for this route.

Key points

Kaspersky attributed the campaign to Silver Fox as the likely group behind it, citing its geography and payload.
The installer ran a signed QnWallpaper.exe that loaded a malicious libcef.dll from the same directory, sideloading ValleyRAT into a trusted process.
The installer disabled Windows Defender through the DisableAntiSpyware registry key, added an autorun entry, and could relaunch with runas when the user lacked administrator rights.
ValleyRAT can collect keystrokes and clipboard contents, take screenshots, and deliver additional modules; it can also mark its process critical so termination triggers a blue screen.
Kaspersky based its account on one customer-submitted installer and did not provide a victim count for this adware route.
Kaspersky reported more than 100,000 detections and over 1,500 unique users across ValleyRAT activity in 2026, mostly in China and India; those figures are not specific to this campaign.
Kaspersky advised avoiding software with a questionable reputation, not adding it to security-tool exclusions, and setting clear workplace policies for third-party software.

Article Details

Attack Vectors: The installer unpacked a modified copy of QN Wallpaper and launched its signed QnWallpaper.exe executable, which loaded a malicious libcef.dll planted in the same directory.
Before the adware component started, the installer disabled Windows Defender through the DisableAntiSpyware registry key and added the program to system autorun entries.
When the logged-in user lacked administrator rights, the malware relaunched itself with runas to acquire them.
The campaign used qnwallpaper[.]keansoft[.]cn as the abused adware download site. Kaspersky described Silver Fox as the likely group behind the campaign.
Defensive Notes: Kaspersky advised avoiding software with a questionable reputation and not adding it to security-tool exclusion lists.
Kaspersky urged organizations to set clear policies for third-party software on work devices and keep staff aware of the threat.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`qnwallpaper[.]keansoft[.]cn`	Abused adware download site in the campaign's delivery chain.
IPV4	`103[.]45[.]66[.]18`	Command-and-control server identified by Kaspersky; the article lists ports 441, 442, and 443.
IPV4	`192[.]253[.]225[.]173`	Command-and-control server identified by Kaspersky; the article lists ports 6666 and 8888.
MD5	`07ddbbe2c71c45577a7a4fbcdba0df91`	MD5 hash identified by Kaspersky for the malicious libcef.dll.
MD5	`8a626d844943da3456b044f38deae3a2`	Hash listed by Kaspersky among campaign indicators; the specific artifact role is not stated.
MD5	`c24e99f9437feacaa63766a3cde3fe3d`	MD5 hash identified by Kaspersky for the submitted installer in the campaign.