ValleyRAT Backdoor Distributed as Malicious Adware
Attackers are distributing the sophisticated ValleyRAT backdoor by disguising its installer as legitimate adware, employing DLL sideloading and disabling Windows Defender to achieve execution.
Cybercriminals are increasingly employing deceptive tactics to deliver malware, often masquerading malicious software as legitimate applications or potentially unwanted programs that users actively seek out. A recent campaign, however, highlights a more insidious approach: distributing the well-known ValleyRAT backdoor under the guise of adware. This method likely leverages the trust users place in signed applications and the common practice of adding adware to security exclusions, thereby bypassing detection.
The investigation began when a client submitted a file (MD5: c24e99f9437feacaa63766a3cde3fe3d) for analysis. Initially classified as adware due to its appearance, deeper inspection revealed suspicious network activity, indicating a more serious threat. The sample was not merely serving ads; it was orchestrating an infection chain designed to deploy the ValleyRAT backdoor.
The malicious installer, identified by its file name structure (e.g., FS_SETUP_DD_173.exe), performs various actions, such as installing legitimate software like DingTalk or Google Chrome, likely as a diversionary tactic. Regardless of the specific installer name, its primary function is to deploy a modified version of the QN Wallpaper tool. This legitimate adware, typically used to bundle partner applications and display ads, is repurposed here to facilitate DLL sideloading.
After unpacking the necessary components to a temporary directory, the installer proceeds to disable Windows Defender using the DisableAntiSpyware registry key. It then launches QnWallpaper.exe, which, along with QnwPlayer.exe, relies on the libcef.dll library. The attackers have replaced the legitimate libcef.dll with a malicious version designed to execute arbitrary code.
DLL sideloading is achieved because QnWallpaper.exe and QnwPlayer.exe have dependencies on libcef.dll. When these legitimate applications start, they load the malicious DLL. The malicious libcef.dll contains a DllMain function that runs automatically upon loading, initiating the backdoor's execution. An additional function, RunDLL, is also present, which the attackers may intend to call manually via rundll32 or a separate executable.
Once executed, the backdoor ensures persistence by adding file extension associations and dropping a corresponding file in the user's startup folder. It then checks for administrator privileges, attempting to elevate its own if necessary using the runas utility. Based on whether the DLL is loaded within QnWallpaper.exe or QnwPlayer.exe, the malware selects and decrypts its payload, which is an AES-encrypted DLL containing the ValleyRAT backdoor. The primary difference between these payloads lies in their configuration, specifically the command-and-control (C2) server addresses.
This new report details the specific methods used by attackers to distribute the ValleyRAT backdoor, including the abuse of DLL sideloading via a tampered QN Wallpaper application and attempts to disable Microsoft Defender. It also highlights the campaign's primary targets in China and India, with over 100,000 detections recorded in 2026 affecting more than 1,500 users, and attributes the activity to the Silver Fox threat group.
This new report from Kaspersky details the technical execution of the ValleyRAT backdoor's disguise within the QN Wallpaper adware, highlighting the use of DLL sideloading with a malicious libcef.dll and the disabling of Windows Defender via registry manipulation. It also notes the malware's ability to flag its own process as critical to trigger a blue screen of death if termination is attempted, and provides specific indicators of compromise including file hashes and command-and-control server details.