ValleyRAT Campaign Hides a Backdoor in Fake Adware

A Windows program presented as adware can create a serious security incident when its visible application is only a decoy. In research published by Securelist, Kaspersky analysts examined an installer that appears to deploy legitimate-looking software but instead launches the ValleyRAT backdoor.

The campaign combines several layers of deception: installer names suggest familiar workplace or consumer applications, a modified adware product provides the execution context, and a malicious library is loaded through a signed-looking application process. Behind that chain, ValleyRAT can collect keystrokes and clipboard data, capture screenshots, gather host information, receive commands, and load additional modules.

Securelist attributes the activity to Silver Fox as a likely operator, based on the malware family and the geographic distribution observed by the researchers. That attribution is an assessment rather than a directly confirmed identity for the individuals behind the samples.

What Securelist confirmed

The investigation began with a file submitted for analysis. Its MD5 hash is c24e99f9437feacaa63766a3cde3fe3d. Securelist initially classified the file as adware, but suspicious network activity led to a deeper examination. The researchers found that the sample’s advertising functionality did not work as expected. Instead, it initiated an infection chain that delivered ValleyRAT.

The installer changes some of its apparent behavior according to a two-letter suffix in its filename. Securelist documented examples that install DingTalk, install Google Chrome, or open the Tencent Meeting download page. These visible actions appear intended to distract the user and make the package look useful. The organization describes that purpose as an assessment, not as a separately verified operator statement.

Regardless of the filename variant, the installer deploys a modified version of QN Wallpaper, a Chinese desktop wallpaper management tool. Securelist notes that the original product is genuine adware that bundles partner applications and displays advertisements. In the analyzed package, QN Wallpaper is used as the vehicle for malicious code execution.

How the infection chain works

The installer unpacks the QN Wallpaper components and malicious files into a directory under C:\Program Files\QNWallpaper\5.4.0.1662\, followed by a randomly generated alphanumeric directory name. The package includes the adware executables, archiving utilities, Electron-related libraries, a malicious libcef.dll, and an encrypted payload stored in a file named PeLoader.

It also adds QnWallpaper to a registry autorun location. Securelist reports that the installer uses the DisableAntiSpyware registry key to disable Windows Defender before launching the application. This is a particularly important detection opportunity: a normally benign-looking software installation is paired with a security-control change and an autorun modification.

The next stage relies on DLL sideloading. Both QnWallpaper.exe and QnwPlayer.exe depend on a library named libcef.dll. The malicious copy is placed where the application can load it, causing code in the library to execute when the process starts. The library exports functions associated with the expected component, helping the application appear structurally legitimate.

Securelist found that the adware itself does not operate normally because the exported functions in the malicious library are placed into an infinite sleep. The library also contains a function called RunDLL that can initiate the malicious code, although the analyzed QN Wallpaper application does not call it. The researchers suspect this function may have been intended for manual use through rundll32 or for a separate executable that was not included in the examined package. That explanation remains a researcher assessment.

Payload staging and execution

When the malicious library is loaded, it runs code that supports persistence by creating a file-extension association and placing a file with the corresponding extension in the user’s Startup folder. The library then follows a sequence of wrapper functions until it reaches the main malicious entry point.

At that point, the code checks whether the current user belongs to the Administrators group. If not, it attempts to relaunch using the Windows runas utility. The supplied research does not establish whether the privilege request succeeds in every environment, so defenders should treat this as an attempted elevation step rather than assume administrative execution.

The payload selected next depends on the host process. When the malicious library runs inside QnWallpaper, it decrypts an AES-encrypted DLL from PeLoader. When it runs inside QnwPlayer, it retrieves a different encrypted payload from resources within libcef.dll. The two ValleyRAT payloads differ in configuration, including their command-and-control server addresses.

After decryption, the library checks the resulting Portable Executable headers. If the structure is valid, it loads the payload into memory and transfers control to its entry point. This design reduces the need to leave the final backdoor as a plainly visible executable on disk and makes analysis more dependent on process and memory behavior.

ValleyRAT capabilities and defensive significance

ValleyRAT begins by parsing a configuration made of key-value pairs concatenated into one string. Securelist reports that the string is reversed as an obfuscation measure and restored during parsing. Configuration fields include the C2 address and port, transport selection between TCP and UDP, execution delays, and options controlling process protection, security-tool checks, and process reinjection.

Several safeguards are designed to keep the backdoor running. A configurable option allows it to inject code into svchost so that the malicious process can be restarted if interrupted. Securelist describes a sequence involving remote memory allocation, a temporary memory-protection change, and a suspended thread. Another configurable setting can mark the process as critical, meaning that forcibly terminating it may trigger a system crash. ValleyRAT also restarts after an unhandled exception, a behavior Securelist says is enabled independently of the configuration.

The backdoor has surveillance capabilities that are relevant to both individual users and enterprise environments. It records keystrokes, monitors the currently focused window, and captures clipboard contents using functions from the DirectInput8 library. The collected information is written to a file on disk. If enabled in its configuration, the malware also checks active windows for applications associated with process or traffic analysis, suggesting an effort to identify investigative or security tooling.

ValleyRAT collects host details including the computer name, IP addresses, idle time, Windows version information, CPU-core count, free disk space, graphics adapter, focused window and title, system bitness, language settings, and the system-directory path.

Its command handling supports rebooting or shutting down the computer, taking screenshots, wiping logs, changing C2 addresses, downloading additional modules, and sending keylogger and clipboard data. Modules may be retrieved from the C2 server or from a third-party address. Securelist reports that downloaded files can be purpose-built DLLs or shellcode. Shellcode is launched through process hollowing involving svchost; DLL modules are loaded into the backdoor’s process, where exported entry points are invoked before the library is unloaded.

Infrastructure and attribution

Securelist lists the following network indicators associated with the analyzed activity:

• 103[.]45[.]66[.]18:441
• 103[.]45[.]66[.]18:442
• 103[.]45[.]66[.]18:443
• 192[.]253[.]225[.]173:6666
• 192[.]253[.]225[.]173:8888

Additional file hashes reported by Securelist include:

• 07ddbbe2c71c45577a7a4fbcdba0df91 — malicious libcef.dll
• 8a626d844943da3456b044f38deae3a8
• c24e99f9437feacaa63766a3cde3fe3d — malicious installer copy

The report also identifies the QN Wallpaper site as hxxps://qnwallpaper[.]keansoft[.]cn/ and references the Tencent Meeting URL as hxxps://meeting[.]tencent[.]com/download/. These values should be handled as indicators, not opened directly.

Securelist says it detected the ValleyRAT backdoor and associated malware more than 100,000 times during 2026, with more than 1,500 unique users affected, primarily in China and India. The research organization says this geography, together with ValleyRAT’s use, points to Silver Fox as the likely group behind the campaign. The supplied research does not identify specific victim organizations, industries, or individual users.

What organizations should do now

• Review endpoint-control changes. Alert on unauthorized writes involving the DisableAntiSpyware registry key, new autorun entries, unusual Startup-folder files, and unexpected file-extension associations.
• Inspect DLL loading relationships. Look for applications loading libcef.dll from unusual installation paths, especially alongside QN Wallpaper components or executables with unexpected hashes.
• Hunt for process and memory anomalies. Investigate QnWallpaper or QnwPlayer spawning unusual processes, attempting elevation through runas, injecting into svchost, creating suspended threads, or changing memory protections.
• Monitor outbound connections. Compare endpoint telemetry with the defanged IP-and-port indicators in the report. Also look for unexplained TCP or UDP connections from wallpaper, adware, Electron, or similarly non-network-sensitive applications.
• Use behavior-based detection. File hashes are useful for retrospective searches, but the campaign can be identified more broadly through the combination of adware installation, Defender tampering, autorun persistence, suspicious DLL loading, encrypted in-memory payload execution, and collection of clipboard or keystroke data.
• Restrict unapproved software. Enforce application control and software-installation policies on managed Windows systems. Treat requests to add questionable applications to antivirus exclusions as a security event requiring review.
• Protect potentially exposed data. If ValleyRAT activity is suspected, isolate the affected endpoint according to incident-response procedures, preserve relevant endpoint and network telemetry, and assess whether credentials, clipboard contents, screenshots, or typed information may have been exposed.

These recommendations are general defensive guidance based on the behaviors described by Securelist. The supplied research does not provide a vendor-specific patch, detection rule, or complete list of affected products.

Conclusion

This campaign demonstrates why “adware” should not automatically be treated as a low-risk classification. The observed installer uses a plausible software lure, disables a security control, establishes startup persistence, sideloads a malicious library, and decrypts ValleyRAT in memory. The backdoor then combines surveillance, host profiling, process-protection features, and modular command execution.

For defenders, the strongest response is layered: control what software can run, monitor security-setting changes, validate DLL load paths, and investigate unusual relationships between adware processes and system services. Hash-based searches can help identify known samples, but behavior-based hunting is essential for finding related packages that use different filenames or payloads.

Sources

Securelist: “ValleyRAT is spreading disguised as adware”