9 minhigh
ValleyRAT masquerading as adware
A malicious installer disguised as adware delivers the ValleyRAT backdoor through DLL sideloading via a modified libcef.dll loaded by the signed QnWallpaper.exe process. The malware disables Windows Defender via registry modification, employs multiple process protection mechanisms including marking the process as critical to trigger BSOD on termination, and performs spyware activities including keylogging and clipboard capture. The campaign is attributed to the Silver Fox group and has primarily affected users in China and India.
Sens:▲ 24hConf:high
IOCs14
10md52ip1file path1url
Detection / Hunteropenrouter
What Happened
Attackers are hiding a dangerous backdoor program called ValleyRAT inside what appears to be legitimate advertising software (a wallpaper application called QN Wallpaper). When users install this seemingly harmless software, it disables Windows Defender and secretly installs a backdoor that can record keystrokes, capture clipboard contents, take screenshots, and download additional malicious software. The malware protects itself by causing system crashes if anyone tries to terminate it. Over 1500 users, primarily in China and India, have been affected. Users should avoid installing software from questionable sources, never add such software to security exclusion lists, and keep their security solutions updated.
Key Takeaways
- ValleyRAT backdoor is distributed disguised as QN Wallpaper adware through a malicious installer with filename-dependent decoy behavior
- DLL sideloading via a malicious libcef.dll loads an AES-encrypted ValleyRAT payload under the signed QnWallpaper.exe process
- Malware disables Windows Defender via the DisableAntiSpyware registry key and uses multiple process protection mechanisms including BSOD on termination, svchost injection for restart, and exception-based restart
- Spyware capabilities include keylogging via DirectInput8, clipboard capture, screenshot capture, and window enumeration to detect analysis tools such as Wireshark and Fiddler
- Campaign attributed to Silver Fox group with over 1500 unique users affected primarily in China and India
Affected Systems
- Windows systems
- Windows Defender (targeted for disabling)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Malicious installer disguised as adware delivered to victim; filename suffix determines decoy behavior (installing DingTalk, Chrome, or opening Tencent Meeting download page)
- Execution & Persistence: Installer disables Windows Defender via DisableAntiSpyware registry key, unpacks QN Wallpaper with malicious components to C:\Program Files\QNWallpaper\5.4.0.1662, adds QN Wallpaper to autorun, and drops a file in the Startup folder via file extension association
- Defense Evasion: QnWallpaper.exe loads malicious libcef.dll via DLL sideloading; libcef.dll exports are put to sleep and malicious code executes from DllMain with a reversed configuration string
- Privilege Escalation: If the current user is not an administrator, the malware uses the runas utility to relaunch itself with elevated privileges
- C2 & Collection: ValleyRAT decrypts the AES-encrypted payload, validates PE headers, loads it into process memory, and connects to C2 servers (103.45.66.18, 192.253.225.173) over TCP or UDP; performs keylogging, clipboard capture, screenshot capture, and analysis tool detection
- Lateral Movement: Additional modules downloaded from C2 or third-party URLs and executed via process hollowing with svchost or in-process DLL loading
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules are provided in the article. The article contains MD5 hashes, C2 IP addresses with ports, and a URL as IOCs for detection purposes.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | Process creation, DLL loading, registry modifications, and remote thread creation are visible to most EDRs. However, the use of a signed process (QnWallpaper.exe) for DLL sideloading and AES-encrypted payloads may evade some signature-based detections. The reversed configuration string adds obfuscation complexity. |
| Network Visibility | High | C2 connections to specific IPs (103.45.66.18, 192.253.225.173) on specific ports (441, 442, 443, 6666, 8888) are detectable via network monitoring. Module downloads use a distinctive User-Agent string (MSIE 6.0) that could be correlated. |
| Detection Difficulty | Moderate | DLL sideloading via a signed process may bypass application whitelisting. The encrypted payload and reversed configuration string add complexity to static analysis. However, the specific IOCs (IPs, hashes, file paths, registry key) are distinctive and detectable with standard EDR and Sysmon telemetry. |
Required Log Sources
- Sysmon Event ID 1 (Process Creation)
- Sysmon Event ID 7 (Image Loaded / DLL loading)
- Sysmon Event ID 8 (CreateRemoteThread)
- Sysmon Event ID 11 (FileCreate)
- Sysmon Event ID 12, 13, 14 (Registry events)
- Windows Event Log for registry modifications
- EDR process telemetry with DLL load monitoring
- Network firewall or proxy logs for C2 connections
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Look for QnWallpaper.exe or QnwPlayer.exe loading libcef.dll from non-standard paths outside the expected application directory, which would indicate DLL sideloading. | Sysmon Event ID 7 (Image Loaded) or EDR DLL load events | Defense Evasion | Low - QN Wallpaper is not a commonly used application in enterprise environments |
| Look for modifications to the DisableAntiSpyware registry key under Windows Defender policies that set it to 1, which disables Windows Defender. | Sysmon Event ID 12, 13 (Registry value set) or Windows Event Log for registry changes | Defense Evasion | Low - this key is rarely modified by legitimate software |
| Look for remote thread creation in svchost.exe originating from non-service host processes, which could indicate the process injection used for the restart mechanism. | Sysmon Event ID 8 (CreateRemoteThread) or EDR remote thread detection | Persistence | Medium - some legitimate management tools may create threads in svchost |
| Look for network connections from QnWallpaper.exe or QnwPlayer.exe to external IPs on non-standard ports, which would indicate C2 communication. | Firewall logs, proxy logs, or EDR network connection events | Command and Control | Low - wallpaper applications should not make external network connections |
| Look for processes being marked as critical via NtSetInformationProcess with ProcessBreakOnTermination, which the malware uses to trigger BSOD on termination. | EDR API call monitoring or ETW kernel trace events | Defense Evasion | Low - this API is rarely used by legitimate software |
Control Gaps
- Application whitelisting may not detect this if QN Wallpaper or the signed QnWallpaper.exe is trusted
- Traditional AV may not detect the threat if the user has added the adware to exclusion lists
- Network-based detection may miss C2 traffic if it uses port 443 which blends with legitimate HTTPS
- Static analysis and file scanning may not detect the AES-encrypted payload before decryption
Key Behavioral Indicators
- QnWallpaper.exe or QnwPlayer.exe loading libcef.dll from C:\Program Files\QNWallpaper\5.4.0.1662\
- Registry modification setting DisableAntiSpyware to 1 under SOFTWARE\Policies\Microsoft\Windows Defender
- Remote thread creation in svchost.exe originating from QnWallpaper.exe or QnwPlayer.exe
- Network connections from QnWallpaper.exe or QnwPlayer.exe to 103.45.66.18 or 192.253.225.173
- File creation in C:\Program Files\QNWallpaper\5.4.0.1662\ with random subdirectory names
- Process marked as critical via NtSetInformationProcess with ProcessBreakOnTermination flag
- Downloads using User-Agent string MSIE 6.0 from QnWallpaper.exe or QnwPlayer.exe process
False Positive Assessment
Medium - The behavioral indicators (DLL sideloading, registry modification, process injection) are distinctive enough to have low false positive rates in most environments. However, some bundled components (7z.dll, chrome_elf.dll) are legitimate and may appear in other software installations. The C2 IPs and file hashes are high-confidence IOCs with minimal false positive risk.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Search endpoint telemetry for the listed MD5 hashes (c24e99f9437feacaa63766a3cde3fe3d, 07ddbbe2c71c45577a7a4fbcdba0df91, 48826d5ca845979d2e6ebd66dc1aae90) to identify any compromised hosts.
- If any of the listed hashes are found, consider isolating the affected hosts using your EDR's host isolation capability if supported.
- Check network and firewall logs for connections to 103.45.66.18 and 192.253.225.173 on ports 441, 442, 443, 6666, and 8888.
Infrastructure Hardening
- Consider blocking the C2 IP addresses (103.45.66.18, 192.253.225.173) at the network perimeter if your firewall policy allows it.
- Evaluate whether QN Wallpaper or similar adware applications should be permitted on corporate endpoints. Consider adding the installation path C:\Program Files\QNWallpaper\ to application control policies.
- If supported by your endpoint protection, consider monitoring for modifications to the DisableAntiSpyware registry key under Windows Defender policies.
- Consider deploying detection logic for DLL sideloading scenarios where a signed process loads a DLL from a non-standard path.
User Protection
- Verify that Windows Defender is enabled on all endpoints and check for the DisableAntiSpyware registry key being set to 1.
- Consider deploying application control policies that prevent execution of software from non-approved sources or non-standard installation paths.
- If your EDR supports it, consider alerting on DLL loading events where a signed process loads a DLL from a non-standard path.
Security Awareness
- Consider updating employee security awareness training to include guidance on the risks of installing adware or potentially unwanted programs on work devices.
- Emphasize that users should never add software to security solution exclusion lists, as this creates blind spots for defenders.
- Consider developing and communicating a policy on the use of third-party software on work devices.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping11 techniques
Tactic
Persistence
Tactic
Privilege Escalation
Tactic
Stealth
Tactic
Defense Impairment
Tactic
Credential Access
Tactic
Discovery
Tactic
Collection
Tactic
Command and Control
Additional IOCs
- Urls:
hxxps://qnwallpaper[.]keansoft[.]cn/- QN Wallpaper distribution site; the malicious installer deploys a modified version of this adware for DLL sideloading
- File Hashes:
7ad1e3ef4e6d9d636c9e7e967733850e(MD5) - 1.zip archive containing QnWallpeper.exe, QnwPlayer.exe, and required modules96b4c1d0683dce22bd3223e1e40689c1(MD5) - 7z.dll - 7z archiver library bundled with the malicious package9b86d3ab6cef15c633933fbbeab39c0a(MD5) - 7z.exe - archiver tool bundled with the malicious packageedfdc30cbd85879776b8f735ea7de1f1(MD5) - chrome_elf.dll - library for launching Electron-based applications bundled with the package6c158c0f8e029342192d4f0d72e102b7(MD5) - QnWallpaper.exe - adware module that loads the malicious libcef.dll for DLL sideloading9a71d6a41cd258b9e89cdc5fc224de73(MD5) - QnwPlayer.exe - adware module that also loads the malicious libcef.dll8a626d844943da3456b044f38deae3a2(MD5) - Additional IOC hash listed in the article IoC section
- Registry Keys:
SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware- Registry value set to 1 by the installer to disable Windows Defender before launching QnWallpaper.exe
- File Paths:
C:\Program Files\QNWallpaper\5.4.0.1662\- Installation directory where QN Wallpaper modules and malicious components are unpacked with a random subdirectory name
- Command Lines:
- Purpose: Privilege escalation by relaunching the process with administrator rights using the runas utility | Tools:
runas| Stage: Privilege Escalation |runas /user:Administrator <executable_path>
- Purpose: Privilege escalation by relaunching the process with administrator rights using the runas utility | Tools:
Showing defanged values
- file_pathC:\ProgramFiles\QNWallpaper\5.4.0.1662\Installation directory where QN Wallpaper modules and malicious components are unpacked with a random subdirectory name
- ip103[.]45[.]66[.]18ValleyRAT C2 server contacted on ports 441, 442, and 443 via TCP
- ip192[.]253[.]225[.]173ValleyRAT C2 server contacted on ports 6666 and 8888
- md507ddbbe2c71c45577a7a4fbcdba0df91Malicious libcef.dll used for DLL sideloading; contains the RunDLL export and mw_entry function that decrypts and loads the ValleyRAT payload
- md548826d5ca845979d2e6ebd66dc1aae90PeLoader file containing the AES-encrypted ValleyRAT backdoor payload loaded when libcef.dll runs inside QnWallpaper.exe
- md56c158c0f8e029342192d4f0d72e102b7QnWallpaper.exe - adware module that loads the malicious libcef.dll for DLL sideloading
- md57ad1e3ef4e6d9d636c9e7e967733850e1.zip archive containing QnWallpeper.exe, QnwPlayer.exe, and required modules
- md58a626d844943da3456b044f38deae3a2Additional IOC hash listed in the article IoC section
- md596b4c1d0683dce22bd3223e1e40689c17z.dll - 7z archiver library bundled with the malicious package
- md59a71d6a41cd258b9e89cdc5fc224de73QnwPlayer.exe - adware module that also loads the malicious libcef.dll
- md59b86d3ab6cef15c633933fbbeab39c0a7z.exe - archiver tool bundled with the malicious package
- md5c24e99f9437feacaa63766a3cde3fe3dMalicious installer that deploys QN Wallpaper adware with ValleyRAT backdoor; also appears as <random>Nedca.exe after unpacking
- md5edfdc30cbd85879776b8f735ea7de1f1chrome_elf.dll - library for launching Electron-based applications bundled with the package
- urlhxxps://qnwallpaper[.]keansoft[.]cn/QN Wallpaper distribution site; the malicious installer deploys a modified version of this adware for DLL sideloading