ValleyRAT Infiltrates Windows Through Signed Adware and Disables Security Defenses

QN Wallpaper Turned into a Backdoor Delivery Vehicle

A modified installer for the Chinese QN Wallpaper application is being used to distribute ValleyRAT, a backdoor also known as Winos 4.0. The campaign, identified on August 31, 2026, has been tentatively linked to the Silver Fox group.

QN Wallpaper is a legitimate desktop wallpaper management program. In its original configuration, it displays advertising banners and promotes applications from partner companies. However, attackers are abusing its digitally signed executable to conceal the malware’s launch.

The analyzed sample is installed in:

C:\Program Files\QNWallpaper\5.4.0.1662\

The path identifies build 5.4.0.1662, which was used in the observed operation. It is not known whether other versions of the application were modified or distributed with the same payload.

The central element of the attack is the trust placed in signed software. A digital signature confirms the association between a file and its signer, but it does not guarantee that the entire directory, the loaded libraries, or the distribution process is safe.

The risk increases when users or administrators add the application to antivirus exclusions. In this scenario, the malware can operate inside an apparently trusted process while also benefiting from exceptions configured for its host software.

Kaspersky based its analysis on a single installer submitted by a customer. The attribution to Silver Fox is therefore not definitive and is based primarily on the geographic distribution and payload characteristics.

DLL Sideloading Inside a Signed Process

The infection chain uses DLL sideloading, a technique in which a legitimate executable is tricked into loading a malicious library placed in the location where it searches for its dependencies.

The installer drops and launches the signed file:

QnWallpaper.exe

When executed, the program loads a library named:

libcef.dll

from the same directory.

In a normal installation, a name like this may appear consistent with a legitimate software dependency. In the analyzed sample, however, libcef.dll contains the component responsible for launching ValleyRAT.

The malicious code therefore runs in the context of QnWallpaper.exe. Security controls focused on the reputation of the main executable or the validity of its signature may not immediately identify the anomaly.

The name libcef.dll is not new in ValleyRAT-related operations: it had already appeared in a malware loader in 2025. The filename alone, however, is not enough to identify an infection, since libraries with the same name may belong to legitimate software. Hashes, file paths, provenance, and behavior must also be assessed.

During the observed sequence, QN Wallpaper’s advertising component remains inactive. To make the execution appear less suspicious, the malware also opens a legitimate Tencent Meetings webpage. Tencent’s service does not appear to have been compromised; it is used solely as a visual decoy.

Defender Disabled, Persistence Established, and Privileges Escalated

Before launching the adware component, the installer modifies the system’s security controls. One of the changes affects the following registry value:

DisableAntiSpyware

The goal is to disable Windows Defender and reduce the likelihood that the malicious components will be detected or removed. In a corporate environment, an unexpected change to this value should trigger immediate investigation.

The installer also establishes persistence through Windows autorun keys. ValleyRAT can therefore relaunch after user logon or system restart.

If the current session does not have administrative rights, the malware attempts to relaunch itself through runas. This is intended to obtain elevated privileges needed to modify security settings and strengthen control over the endpoint.

ValleyRAT also includes a particularly aggressive self-defense feature: it can mark its own process as critical. If an administrator or security tool attempts to terminate it, Windows may respond with a blue screen and halt the computer.

Manual removal therefore requires caution. Terminating the process without first isolating the system and assessing this setting could cause an abrupt shutdown, resulting in the loss of unsaved data and temporary system unavailability.

From User Surveillance to Full Computer Control

Once active, ValleyRAT gives the operator extensive control over the compromised system. The observed capabilities include keylogging, clipboard collection, and screenshot capture.

These capabilities can be used to steal credentials, conversations, documents, one-time codes, and information copied between applications. The risk affects both individual users and organizations that allow unapproved software on work devices.

The backdoor can also receive and load additional modules. The initial installer therefore does not define the full scope of the incident: operators can later expand the malware’s capabilities or introduce other tools.

Communications with the command-and-control infrastructure allow attackers to issue commands to the infected machine and transfer data. No CVSS score has been provided, nor is there a formal severity classification, since this is a malware campaign rather than a specific software vulnerability.

Operationally, the combination remains dangerous: antivirus deactivation, administrative privileges, persistence, information collection, remote control, and the ability to hinder removal.

During 2026, Kaspersky recorded more than 100,000 detections related to ValleyRAT and associated malware across more than 1,500 unique users, primarily in China and India. These figures describe the overall activity observed and do not represent the number of victims in the QN Wallpaper campaign.

Evidence Linking the Operation to Silver Fox

Using a legitimate application to execute a malicious DLL is consistent with techniques previously associated with Silver Fox. Approximately five weeks earlier, Cato Networks had documented a campaign targeting a Japanese manufacturer in which the group abused authentic programs for similar purposes.

Kaspersky had also linked Silver Fox to a tax-themed operation targeting organizations in India and Russia. The geographic distribution, payload, and loading method therefore support the attribution, although they do not make it conclusive.

The fact that the analysis is based on a single installer also limits the reconstruction of the operation. The full distribution channel, the number of installations attributable to the sample, and the possible existence of other modified builds remain unknown.

The domain associated with the adware download is:

qnwallpaper[.]keansoft[.]cn

A program downloaded from a site that appears to distribute legitimate software may lead users to lower their defenses. A valid digital signature and a plausible interface further reinforce the deception.

Indicators to Hunt for and Containment Measures

Administrators should check for the simultaneous presence of QnWallpaper.exe and a suspicious libcef.dll in the QN Wallpaper directory. A valid signature on the executable should not end the investigation.

The MD5 hashes associated with the sample are:

c24e99f9437feacaa63766a3cde3fe3d
07ddbbe2c71c45577a7a4fbcdba0df91
8a626d844943da3456b044f38deae3a2

The second value identifies the malicious libcef.dll, while the first corresponds to the analyzed installer. The observed command-and-control addresses are:

103.45.66.18:441
103.45.66.18:442
103.45.66.18:443
192.253.225.173:6666
192.253.225.173:8888

Investigations should also cover changes to DisableAntiSpyware, new entries in autorun keys, and connections to the listed addresses. The meeting[.]tencent[.]com webpage is legitimate and, by itself, is not evidence of compromise.

As a preventive measure, organizations should prohibit antivirus exclusions granted without verification, restrict the installation of adware, and apply allowlisting policies based on more than digital signatures alone. Controls that verify the integrity of DLLs loaded by signed processes are also useful.

If these indicators are found, the device should be isolated from the network before remediation begins. Logs and other artifacts should be preserved, additional endpoints should be checked, and any potentially intercepted credentials should be reset. Directly terminating the process must be considered carefully, since marking it as a critical process could cause Windows to crash.