ValleyRAT masquerading as adware
This report details a sophisticated campaign utilizing adware to distribute the ValleyRAT backdoor. Attackers leveraged a legitimate adware application, signed by a developer, to bypass security measures and install the backdoor. The ValleyRAT is a powerful backdoor capable of extensive data collection – including keystrokes, clipboard contents, screenshots, and system information – and can perform actions like rebooting, shutting down, and wiping logs. The campaign, primarily targeting China and India, is attributed to Silver Fox, a known operator of this malware family, highlighting the danger of seemingly benign software acting as a delivery mechanism for advanced threats.
A client recently alerted us to a file with the MD5 hash c24e99f9437feacaa63766a3cde3fe3d and requested we add it to our detection database. Initially classified as adware, a deeper analysis revealed a more complex operation – the ValleyRAT backdoor. The attackers cleverly used a legitimate adware application, QN Wallpaper, to distribute the malware, exploiting the fact that users often manually add such apps to their security solutions’ exclusion lists.
Malicious installer The file shared with us was an installer designed to perform different actions based on a two-letter suffix in the filename. These actions were intended to divert the user’s attention away from the malware’s true purpose. Regardless of the filename, the installer deployed QnWallpaper, a genuine adware application that delivers bundled partner apps and displays ad banners. However, the installer’s primary function was to install the ValleyRAT backdoor.
QN Wallpaper and QnwPlayer QNWallpaper and QnwPlayer are both designed to appear as legitimate applications, but they are ultimately Trojan horses. QnWallpaper delivers bundled partner apps, while QnwPlayer is used to load malicious DLLs. Both applications rely on libcef.dll, a Chromium Embedded Framework library, to function.
DLL Sideloading QnWallpaper and QnwPlayer don’t actually perform their advertised functions correctly; they are designed to be disabled by security software. However, if the security software is bypassed, the library gets loaded, and the malicious code is executed. The malicious functionality within libcef.dll is invoked by a call to DllMain, which runs automatically when the library is loaded. Alongside the original exports, the library also contains a function named RunDLL, which likewise initiates execution of the malicious code. QnWallpaper never calls this function. We suspect the attackers intended to invoke it manually via rundll32 or planned to use a separate executable for this purpose, one that wasn’t included in the package downloaded by the sample.
ValleyRAT ValleyRAT begins its operation by parsing its configuration, which consists of key:value pairs concatenated into a single string. To obfuscate this configuration, the attackers wrote the string in reverse. During parsing, the backdoor restores the correct character order and reads the key values one by one. The set of keys is the same regardless of which process the backdoor is running in. Some of the configuration fields are listed below:
ValleyRAT employs several techniques to protect its process, including injecting code into svchost to restart the process (a configurable option), marking its own process as critical (a configurable option), and restarting on an unhandled exception (always active). The backdoor also has spyware functionality, tracking keystrokes and the currently focused window using functions from the DirectInput8 library, and capturing clipboard contents. All collected data is saved to a file on disk.
If the ll key in the configuration is set to 1, ValleyRAT periodically checks for active windows belonging to applications that could be used to analyze processes or traffic. Window enumeration is done via the EnumWindows function, using the following callback:
After completing these checks, the backdoor collects system information, including: Host name, Host IP addresses, User idle time, Detailed Windows version information (ProductName, EditionId, DisplayVersion), Number of CPU cores, Free disk space, Graphics adapter, Currently focused window and its title, System bitness, Language settings, Path to the system directory. On command, the backdoor can perform the actions typical of this malware category: Rebooting the computer, Shutting down the computer, Taking a screenshot, Wiping logs, Updating its C2 addresses, Downloading additional modules, Sending keylogger logs along with clipboard contents.
Additional modules can take the form of purpose-built dynamic libraries or shellcode. If the payload is shellcode, the backdoor uses process hollowing with svchost to launch the module. If the module is a dynamic library, the backdoor loads the PE file into its own process, calls DllMain, and searches for a Main function among the exported functions. Once Main has been called, the library is unloaded from memory.
Targets and attribution Over the course of 2026, we detected the ValleyRAT backdoor and its associated malware more than 100,000 times, with more than 1500 unique users affected, primarily in China and India. This attack geography, combined with the use of the ValleyRAT backdoor, points to Silver Fox, a known operator of this malware family, as the likely group behind the campaign.
IoC MD5: 07ddbbe2c71c45577a7a4fbcdba0df91 C2: c24e99f9437feacaa63766a3cde3fe3d 8a626d844943da3456b044f38deae3a2