ValleyRAT Backdoor Distributed via Trojanized QN Wallpaper Adware, Linked to Silver Fox
September 5th, 2026
High
Our Cyber Threat Intelligence Unit is monitoring an active malware campaign linked to the threat actor tracked as Silver Fox, in which the ValleyRAT backdoor (also tracked as Winos 4.0) is distributed concealed inside a modified version of QN Wallpaper, a legitimate, digitally signed Chinese desktop wallpaper application. Disclosed by Kaspersky on August 31, 2026, the campaign is notable because it abuses a genuinely signed adware application to run malicious code inside a trusted process, and exploits the common practice of adding adware to antivirus exclusion lists, effectively turning the victim's own security configuration into a blind spot. The installer disables Windows Defender, establishes persistence, and deploys a fully functional keylogging, screenshot-capable, and remotely controlled backdoor that attempts privilege escalation and can deliver additional modules on operator command. Kaspersky recorded over 100,000 detections of ValleyRAT and associated malware across 2026, affecting more than 1,500 unique users, primarily in China and India. There is no patch applicable to this campaign; defense relies on policy controls, user awareness, and endpoint detection rule updates.
Technical Details
Threat Type: Backdoor / Remote Access Trojan with keylogging, modular downloader, and defense evasion functionality.
Severity: High.
Affected Systems: Windows endpoints running the modified QN Wallpaper installer (QnWallpaper.exe / QnwPlayer.exe), version 5.4.0.1662, or exposed to the malicious installer variants FS_SETUP_DD/GG/HY_173.exe
Threat Actor: Linked to Silver Fox; Kaspersky assesses Silver Fox as the likely operator based on attack geography and the group's established use of the ValleyRAT malware family, though the campaign has not been formally attributed to a named APT designation.
Exploit Status: Not vulnerability-based. Compromise is achieved through a trojanized installer, DLL sideloading, and social engineering rather than exploitation of a software vulnerability.
Attack Chain:
Initial Access and Setup: The malicious installer unpacks a modified QN Wallpaper into a randomly named subdirectory under C:\Program Files\QNWallpaper\5.4.0.1662, disables Windows Defender using the DisableAntiSpyware registry key, adds a registry autorun entry, and launches QnWallpaper.exe. Depending on the installer's filename variant, it also installs the genuine DingTalk or Google Chrome application, or opens the legitimate Tencent Meeting download page, as a decoy to divert the user's attention from the malicious activity running in the background.
DLL Sideloading: QnWallpaper.exe and QnwPlayer.exe, both legitimately signed, automatically load the attacker's malicious libcef.dll from the same directory on startup, executing the ValleyRAT loader inside a trusted signed process that bypasses signature-based security controls.
Post-Sideloading Persistence and Privilege Escalation: Once libcef.dll is loaded, the malware establishes an additional persistence mechanism via file extension association and a Startup folder entry, checks whether the current user belongs to the Administrators group, and, if not, attempts to relaunch itself with elevated privileges using the runas utility.
Payload Decryption and Backdoor Execution: The malicious libcef.dll decrypts an AES-encrypted ValleyRAT DLL payload, sourced from the PeLoader file when running inside QnWallpaper.exe or from libcef.dll's own embedded resources when running inside QnwPlayer.exe, validates the PE headers, loads the backdoor into process memory, and hands execution control to DllMain.
Post-Compromise Operations: ValleyRAT connects to attacker C2 infrastructure, begins keylogging and clipboard capture, collects detailed system information, and awaits operator commands to reboot or shut down the system, take screenshots, wipe logs, update C2 addresses, or download and execute additional modules via DLL loading or process hollowing. Depending on configuration, it may also inject a restart thread into svchost.exe and mark its own process as critical to complicate termination; restart-on-exception behavior is always active regardless of configuration.
Impact
Full Backdoor Access via Trusted Process: ValleyRAT runs inside a digitally signed and trusted process, meaning standard controls that rely on process reputation or signature validation will not flag the malicious activity.
Antivirus Exclusion Exploitation: Organizations or users who have added QN Wallpaper or similar adware to antivirus exclusion lists specifically to prevent interference with its advertising features create a permanent blind spot that ValleyRAT exploits to operate undetected.
Credential and Sensitive Data Theft: The keylogger and clipboard capture functionality gives the operator access to any content typed or copied by the victim, including passwords and other sensitive data, stored to disk and exfiltrated on command.
Operator-Defined Scope via Modular Architecture: The operator can expand the malware's capabilities at any time by pushing additional modules; the initial payload is not the ceiling of what the malware can do.
Configurable Anti-Removal Design: Depending on build configuration, the malware may inject a restart thread into svchost.exe and flag its own process as critical, which can complicate manual removal and, in the case of critical-process flagging, trigger a system crash if the process is terminated; restart-on-exception behavior is always active regardless of configuration.
Scale of Campaign: Kaspersky detected ValleyRAT and associated malware over 100,000 times across 2026, affecting more than 1,500 unique users; the adware delivery route represents a new distribution method beyond previously documented Silver Fox campaigns.
Established Threat Actor Pattern: Silver Fox's documented activity includes a campaign targeting a Japanese industrial manufacturer in July 2026, in which the group combined BYOVD driver abuse with DLL sideloading through legitimate PDF utilities to deploy ValleyRAT, as reported by Cato CTRL. This QN Wallpaper campaign reflects the group's continued evolution and diversification of delivery methods.
Detection Method
Monitor endpoint security logs for execution of QnWallpaper.exe or QnwPlayer.exe from a subdirectory under C:\Program Files\QNWallpaper\5.4.0.1662, followed by loading of a libcef.dll from that same subdirectory, which may indicate DLL sideloading activity.
Alert on use of the DisableAntiSpyware registry key to disable Windows Defender in connection with QN Wallpaper installation activity.
Monitor for registry autorun entries referencing QnWallpaper.exe or files in the C:\Program Files\QNWallpaper\ directory that were not added by an approved software deployment process, as well as new file extension associations and Startup folder entries created shortly after QnWallpaper.exe execution.
Alert on outbound network connections from QnWallpaper.exe or QnwPlayer.exe processes to external IP addresses, particularly to 103.45.66.18 (ports 441, 442, 443) or 192.253.225.173 (ports 6666, 8888), which are confirmed ValleyRAT C2 servers.
Monitor for process injection activity targeting svchost.exe originating from QnWallpaper.exe or QnwPlayer.exe, which may indicate the ValleyRAT svchost persistence mechanism is being established (present in some but not all builds).
Detect use of the runas utility invoked by a process loaded from the QNWallpaper directory following DLL sideloading, indicating the malware is attempting to escalate privileges when not already running as administrator.
Review endpoint DLP and file system logs for creation of data collection files on disk containing keystroke or clipboard data in the user profile or application directories associated with QNWallpaper.
Audit antivirus and EDR exclusion lists for the presence of QN Wallpaper, QnWallpaper.exe, or the QNWallpaper install directory, and remove any such exclusions immediately pending investigation.
Indicators of Compromise
Indicator Type | Indicator | Description |
Hash (MD5) | 07ddbbe2c71c45577a7a4fbcdba0df91 | Malicious libcef.dll library performing DLL sideloading and payload decryption |
Hash (MD5) | c24e99f9437feacaa63766a3cde3fe3d | Malicious installer copy |
Hash (MD5) | 8a626d844943da3456b044f38deae3a2 | Associated malicious file (unspecified by source) |
IP:Port | 103[.]45[.]66[.]18:441 | ValleyRAT C2 server |
IP:Port | 103[.]45[.]66[.]18:442 | ValleyRAT C2 server |
IP:Port | 103[.]45[.]66[.]18:443 | ValleyRAT C2 server |
IP:Port | 192[.]253[.]225[.]173:6666 | ValleyRAT C2 server (alternate configuration) |
IP:Port | 192[.]253[.]225[.]173:8888 | ValleyRAT C2 server (alternate configuration) |
Domain | qnwallpaper[.]keansoft[.]cn | QN Wallpaper download site; abused as part of the installer delivery chain |
Domain | meeting[.]tencent[.]com/download/ | Legitimate Tencent Meeting page; opened as a decoy depending on installer filename variant |
Recommendations
Remove QN Wallpaper immediately: If found on corporate endpoints, remove the installation directory at C:\Program Files\QNWallpaper, delete associated registry autorun entries and file extension associations, restore the DisableAntiSpyware registry key, and re-enable Windows Defender or equivalent endpoint protection.
Audit AV/EDR exclusions: Remove exclusions for any adware, potentially unwanted programs, or unsigned software that was added to exclusion lists by users or helpdesk processes; exclusions for adware are a known attacker exploitation path in this campaign.
Block known infrastructure: Block the confirmed C2 IP addresses at the network perimeter and DNS layer: 103.45.66.18 (ports 441, 442, 443) and 192.253.225.173 (ports 6666, 8888).
Block or alert on outbound connections to qnwallpaper[.]keansoft[.]cn at the DNS and web proxy layer, and flag any connections to this domain in historical proxy logs as a potential retroactive indicator of installer delivery.
Update EDR and endpoint security detection rules to alert on DLL sideloading activity involving libcef.dll loaded by QnWallpaper.exe or QnwPlayer.exe from a subdirectory of the QNWallpaper install directory, and on process injection from these processes into svchost.exe.
Enforce a third-party software allowlist policy on corporate endpoints that requires formal approval before any application, including adware, is installed or added to security exclusion lists; unapproved software in the QNWallpaper category should be blocked by application control.
Conduct a retroactive hunt using the file hashes, C2 IP addresses, and host artifact registry keys listed in the IOC section above across all corporate endpoints for the period of 2026 to date, to identify any infections that preceded detection rule updates.
Educate users not to install software of questionable reputation on work devices, and specifically not to add such software to antivirus exclusions even when the software requests it; this is the social engineering mechanism that makes this campaign effective.
Monitor Silver Fox threat intelligence feeds for new delivery methods, updated C2 infrastructure, or additional campaigns; this group has demonstrated active and evolving operations across 2026 targeting multiple geographies and sectors.
Conclusion
The ValleyRAT campaign documented by Kaspersky in August 2026 demonstrates how legitimate software signatures and trusted process identity can be weaponized to defeat endpoint security controls that rely on reputation-based trust. By choosing a genuine adware application that users routinely whitelist and add to antivirus exclusions, the threat actor turned a common, widely tolerated security gap into a reliable delivery mechanism for a fully capable espionage and data-theft backdoor. The scale of 100,000 detections and 1,500 affected users across 2026 confirms this is an active, ongoing campaign, not an isolated incident. Organizations should treat any unmanaged third-party or adware software on corporate endpoints as a potential attack surface and enforce strict policies on both software installation and security exclusion management.