ValleyRAT Backdoor Distributed as Malicious Adware
Attackers are distributing the sophisticated ValleyRAT backdoor by disguising its installer as legitimate adware, employing DLL sideloading and disabling Windows Defender to achieve execution.
Cybercriminals are increasingly employing deceptive tactics to deliver malware, often masquerading malicious software as legitimate applications or potentially unwanted programs that users actively seek out. A recent campaign, however, highlights a more insidious approach: distributing the well-known ValleyRAT backdoor under the guise of adware. This method likely leverages the trust users place in signed applications and the common practice of adding adware to security exclusions, thereby bypassing detection.
The investigation began when a client submitted a file (MD5: c24e99f9437feacaa63766a3cde3fe3d) for analysis. Initially classified as adware due to its appearance, deeper inspection revealed suspicious network activity, indicating a more serious threat. The sample was not merely serving ads; it was orchestrating an infection chain designed to deploy the ValleyRAT backdoor.
The malicious installer, identified by its file name structure (e.g., FS_SETUP_DD_173.exe), performs various actions, such as installing legitimate software like DingTalk or Google Chrome, likely as a diversionary tactic. Regardless of the specific installer name, its primary function is to deploy a modified version of the QN Wallpaper tool. This legitimate adware, typically used to bundle partner applications and display ads, is repurposed here to facilitate DLL sideloading.
After unpacking the necessary components to a temporary directory, the installer proceeds to disable Windows Defender using the DisableAntiSpyware registry key. It then launches QnWallpaper.exe, which, along with QnwPlayer.exe, relies on the libcef.dll library. The attackers have replaced the legitimate libcef.dll with a malicious version designed to execute arbitrary code.
DLL sideloading is achieved because QnWallpaper.exe and QnwPlayer.exe have dependencies on libcef.dll. When these legitimate applications start, they load the malicious DLL. The malicious libcef.dll contains a DllMain function that runs automatically upon loading, initiating the backdoor's execution. An additional function, RunDLL, is also present, which the attackers may intend to call manually via rundll32 or a separate executable.
Once executed, the backdoor ensures persistence by adding file extension associations and dropping a corresponding file in the user's startup folder. It then checks for administrator privileges, attempting to elevate its own if necessary using the runas utility. Based on whether the DLL is loaded within QnWallpaper.exe or QnwPlayer.exe, the malware selects and decrypts its payload, which is an AES-encrypted DLL containing the ValleyRAT backdoor. The primary difference between these payloads lies in their configuration, specifically the command-and-control (C2) server addresses.