ValleyRAT Exploits Adware to Evade Detection

“Over the course of 2026, we detected the ValleyRAT backdoor and its associated malware more than 100,000 times, with more than 1500 unique users affected, primarily in China and India.”

How a seemingly ordinary installer diverted attention

An installer sample (MD5 c24e99f9437feacaa63766a3cde3fe3d) that a client submitted for classification arrived initially labeled as adware, but researchers observed suspicious network activity and dug deeper. The installer intentionally changes behavior depending on a two‑letter suffix in its filename positioned before a numeric string. Examples reported in the sample set include:

• FS_SETUP_DD_173.exe — installs DingTalk
• FS_SETUP_GG_173.exe — installs Google Chrome
• FS_SETUP_HY_173.exe — opens a Tencent meeting download page

Those apparent diversionary actions are paired with a much more dangerous payload: the installer always unpacks a modified Chinese desktop “QN Wallpaper” application and uses that adware client as the cover for a backdoor delivery chain.

DLL sideloading, persistence, and disabling Defender

Regardless of the filename, the installer unpacks files to C:\Program Files\QNWallpaper\5.4.0.1662\ and adds QN Wallpaper to registry autorun entries. The unpacked set includes legitimate components (7z libraries, an Electron support library) alongside a malicious libcef.dll and an encrypted payload named PeLoader. Notable files and hashes saved in that directory (as reported) include:

• 1.zip — archive of adware files
• 7z.dll / 7z.exe — archiver libraries
• chrome_elf.dll — Electron helper
• libcef.dll (MD5 07ddbbe2c71c45577a7a4fbcdba0df91) — malicious library
• PeLoader (48826d5ca845979d2e6ebd66dc1aae90) — encrypted backdoor
• QNWallpaper.exe and QnwPlayer.exe — adware modules

The installer also sets the DisableAntiSpyware registry key to disable Windows Defender before launching QnWallpaper.exe. Attackers use DLL sideloading via libcef.dll: QnWallpaper.exe and QnwPlayer.exe link to libcef.dll, which runs malicious code through DllMain and exposes an additional RunDLL function that the researchers suspect was intended to be invoked via rundll32 or by a missing helper executable.

Persistence is established by adding a file‑extension association and placing a file in the per‑user Start Menu Startup folder. The malicious library will attempt to elevate to administrator (using runas) if the current user is not an administrator.

ValleyRAT — configuration, protections, and spying capabilities

After successful sideloading and decryption, the embedded payload is the ValleyRAT backdoor. Both encrypted payload streams (one loaded from PeLoader, the other from libcef.dll resources) decrypt to an AES‑encrypted DLL. The backdoor parses a configuration string (the authors reversed the string for obfuscation) containing key:value pairs that control core behavior. Configuration fields include:

• p? — C2 server IP
• o? — C2 port
• t? — protocol (1 = TCP, 0 = UDP)
• dd / cl — sleep durations
• bh — mark process as critical (1 = yes)
• ll — whether to check for analysis tools
• sh — whether to inject into svchost to enable restart

ValleyRAT applies multiple self‑protection techniques: optional code injection into svchost to restart the malicious process, a configurable option to mark its process as critical (so termination can cause a system crash), and an always‑active restart-on-unhandled-exception mechanism. The backdoor gathers system and environment data (host and IP addresses, Windows version fields, CPU core count, free disk space, focused window, language, system directory path) and can perform a broad set of remote actions: reboot/shutdown, screenshots, log wiping, updating C2 addresses, downloading and executing additional modules, and exfiltrating keystrokes and clipboard contents.

For spying, ValleyRAT uses DirectInput8 functions to capture keystrokes and monitors the focused window; captured data and clipboard contents are written to disk for exfiltration. The backdoor can download additional modules either as PE files or as shellcode; shellcode modules are launched via svchost process hollowing, while DLL modules are loaded into the backdoor process and invoked by DllMain or a Main export.

Targets, attribution, and observed impact

Detection telemetry compiled in 2026 shows more than 100,000 detections and more than 1,500 unique affected users, concentrated primarily in China and India. The report links the campaign and the use of ValleyRAT to the operator known as Silver Fox and describes the actor’s motivation as a mixture of cyberespionage and financial gain.

What this means for technologists, procurement teams, and individual users

• Technologists and security teams: look for the presence of QNWallpaper installs in C:\Program Files\QNWallpaper\5.4.0.1662\<…>, monitor for the libcef.dll hash (MD5 07ddbbe2c71c45577a7a4fbcdba0df91) and the installer hash (MD5 c24e99f9437feacaa63766a3cde3fe3d), and watch autorun entries, startup folder files, and registry DisableAntiSpyware changes.
• Procurement and enterprise policy owners: enforce clear rules on third‑party and bundled software for work devices; the campaign demonstrates how signed or familiar adware clients can be repurposed to run covert backdoors.
• Individual users: avoid installing software with questionable reputations and do not add such applications to security‑solution exclusion lists — the report warns that users often exclude adware to preserve perceived functionality, which the attackers exploit.

The single‑vector lesson is stark: a familiar adware client, when modified and combined with DLL sideloading, can turn a benign‑looking installer into a delivery vehicle for a resilient backdoor that harvests keystrokes, clipboard data and more. The report’s IoCs include file hashes and network endpoints readers can use for triage.

• Noted MD5 hashes: 07ddbbe2c71c45577a7a4fbcdba0df91, c24e99f9437feacaa63766a3cde3fe3d, 8a626d844943da3456b044f38deae3a2
• Observed network endpoints: 103.45.66.18:441, 103.45.66.18:442, 103.45.66.18:443, 192.253.225.173:6666, 192.253.225.173:8888

Read the original analysis here: https://securelist.com/valleyrat-backdoor-adware/121175/