ValleyRAT Backdoor Disguised as Adware Uses DLL Sideloading to Spy on Victims
Summary
Researchers found installers posing as adware that deploy the ValleyRAT backdoor through DLL sideloading, disable Windows Defender, and collect keystrokes, clipboard data, screenshots, and system information.
Key points
- Malicious installers deploy a modified QN Wallpaper app and use its signed process to sideload a malicious libcef.dll.
- The installer disables Windows Defender through a registry key and adds QN Wallpaper to startup.
- The malicious DLL decrypts and loads ValleyRAT payloads, with different configurations depending on the host process.
- ValleyRAT can capture keystrokes and clipboard contents, take screenshots, collect system information, and download and execute additional modules.
- The backdoor can use svchost injection to restart itself and can be configured to mark its process as critical.
- Researchers detected the malware more than 100,000 times in 2026, with over 1,500 unique users affected, primarily in China and India.
- The targeting and use of ValleyRAT point to Silver Fox as the likely operator.
Article Details
- Attack Vectors
- A malicious installer deploys QN Wallpaper and uses a malicious libcef.dll to sideload and execute ValleyRAT.
- The installer disables Windows Defender through the DisableAntiSpyware registry key.
- ValleyRAT can inject code into svchost to restart itself and can use process hollowing to launch downloaded shellcode modules.
- ValleyRAT downloads and executes additional modules from links supplied by its operator.
- Defensive Notes
- Keep employee cybersecurity awareness up to date and enforce clear policies on third-party software on work devices.
- Avoid installing software with a questionable reputation and do not add such software to security-product exclusion lists.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 103[.]45[.]66[.]18 | ValleyRAT C2 server, listed with ports 441, 442, and 443. |
| IPV4 | 192[.]253[.]225[.]173 | ValleyRAT C2 server, listed with ports 6666 and 8888. |
| MD5 | 07ddbbe2c71c45577a7a4fbcdba0df91 | MD5 of the malicious libcef.dll used to load ValleyRAT. |
| MD5 | 48826d5ca845979d2e6ebd66dc1aae90 | MD5 of PeLoader, which contains the encrypted ValleyRAT backdoor. |
| MD5 | 7ad1e3ef4e6d9d636c9e7e967733850e | MD5 of the archive bundled with the malicious installer and containing the deployed adware files and modules. |
| MD5 | c24e99f9437feacaa63766a3cde3fe3d | MD5 of the malicious installer that triggers the ValleyRAT infection chain. |
MITRE ATT&CK
T1055 · Process InjectionValleyRAT allocates memory in svchost and injects code there to restart the backdoor.T1055.012 · Process HollowingValleyRAT uses process hollowing with svchost to launch downloaded shellcode modules.T1056.001 · KeyloggingValleyRAT tracks keystrokes and saves collected data to disk.T1082 · System Information DiscoveryValleyRAT collects host and system details, including the hostname, Windows version, CPU cores, disk space, and system bitness.T1105 · Ingress Tool TransferValleyRAT downloads additional modules from links supplied by its operator and executes them.T1113 · Screen CaptureValleyRAT can take screenshots on command.T1115 · Clipboard DataValleyRAT captures clipboard contents and can send them to its C2.T1547.001 · Registry Run Keys / Startup FolderThe installer adds QN Wallpaper to registry autorun entries, and the malware also drops a file into the Startup folder.T1562.001 · Disable or Modify ToolsThe installer uses the DisableAntiSpyware registry key to disable Windows Defender.T1574.002 · DLL Side-LoadingThe attackers use a malicious libcef.dll loaded by QnWallpaper.exe and QnwPlayer.exe to execute code under those signed processes.
Threat Actors
Malware
Products
DingTalkInstalls DingTalk, a workplace collaboration platformGoogle ChromeInstalls Google ChromeQN WallpaperRegardless of the file name, the installer deploys a modified Chinese desktop wallpaper management tool called QN Wallpaper (hxxps://qnwallpaper[.]keansoft[.]cn/) and adds it to the registry’s autorun entries.Windows DefenderAfter unpacking, the installer uses the DisableAntiSpyware registry key to disable Windows Defender and then launches QnWallpaper.exe.
Countries
ChinaOver the course of 2026, we detected the ValleyRAT backdoor and its associated malware more than 100,000 times, with more than 1500 unique users affected, primarily in China and India.IndiaOver the course of 2026, we detected the ValleyRAT backdoor and its associated malware more than 100,000 times, with more than 1500 unique users affected, primarily in China and India.