The Silver Fox threat actor has been distributing the ValleyRAT backdoor disguised as a signed Chinese adware application called QN Wallpaper, a legitimate desktop-wallpaper tool. By hiding malware within a signed application, attackers exploit the tendency of users to add trusted or familiar software to antivirus exclusion lists. This allows the malware to run under a trusted process, effectively bypassing antivirus detection. Kaspersky, a Russian cybersecurity vendor, identified and reported on this campaign. The technique highlights the growing abuse of signed software and user trust as a vector for malware delivery. The campaign demonstrates sophisticated social engineering combined with code-signing abuse to evade security controls.
The threat actor Silver Fox distributes the ValleyRAT backdoor (also tracked as Winos 4.0) disguised as a signed Chinese adware application called QN Wallpaper. The attack uses DLL sideloading: the installer unpacks a modified copy of QN Wallpaper and runs its signed executable (QnWallpaper.exe), which then loads a malicious libcef.dll placed in the same directory. Because the malicious DLL executes within a legitimately signed process, it bypasses security controls that trust the signature. Before the adware component starts, the installer disables Windows Defender via the DisableAntiSpyware registry key and adds itself to system autorun entries. If the logged-in user lacks administrator rights, the malware relaunches itself using 'runas' to acquire elevated privileges. ValleyRAT can also flag its own process as critical, so any attempt to terminate it triggers a Blue Screen of Death (BSOD). Capabilities include keylogging, clipboard capture, screenshot taking, and delivery of additional malicious modules. Across 2026, Kaspersky recorded over 100,000 detections of ValleyRAT and associated malware affecting over 1,500 unique users, mostly in China and India.
1. Avoid installing software of questionable reputation, particularly adware bundlers and unofficial Chinese desktop tools. 2. Never add software of dubious reputation to antivirus or security solution exclusion lists. 3. Block the identified C2 IP addresses (103.45.66.18 and 192.253.225.173) and associated ports (441, 442, 443, 6666, 8888) at the network perimeter. 4. Block or monitor the domain qnwallpaper[.]keansoft[.]cn. 5. Monitor for the presence of the malicious libcef.dll in application directories, especially alongside signed executables. 6. Monitor for creation or modification of the DisableAntiSpyware registry key. 7. Check for and remove the install directory C:\Program Files\QNWallpaper\5.4.0.1662\ if present. 8. Scan for the identified MD5 hashes across endpoints. 9. Set clear organizational policies on third-party software installation on work devices. 10. Train staff on threats posed by adware and affiliate-network software. 11. Monitor for processes flagged as critical that attempt to cause BSOD on termination. 12. Monitor for use of 'runas' to escalate privileges from standard user accounts.
MD5: c24e99f9437feacaa63766a3cde3fe3d (installer), MD5: 07ddbbe2c71c45577a7a4fbcdba0df91 (malicious libcef.dll), MD5: 8a626d844943da3456b044f38deae3a2, C2 IP: 103.45.66.18 (ports 441, 442, 443), C2 IP: 192.253.225.173 (ports 6666, 8888), Domain: qnwallpaper[.]keansoft[.]cn, Decoy domain: meeting[.]tencent[.]com, Registry key: DisableAntiSpyware, File path: C:\Program Files\QNWallpaper\5.4.0.1662\, Malicious DLL filename: libcef.dll, Signed executable: QnWallpaper.exe
