2026-09-01 · view entry permalink →
ValleyRAT (Winos 4.0) hides inside a re-signed Chinese wallpaper app: DLL sideloading, a self-restoring svchost injection, and a Windows Defender kill switch
Kaspersky's Securelist published an analysis on 2026-08-31 of a ValleyRAT (Winos 4.0) distribution chain hidden inside a re-signed copy of QN Wallpaper, a genuine Chinese desktop-wallpaper and adware-bundling tool. The installer drops a modified QN Wallpaper build and adds it to autorun; before launching the adware, it flips the DisableAntiSpyware registry key to disable Windows Defender, relaunching itself via runas first if the logged-in user lacks administrator rights (Kaspersky Securelist, 2026-08-31; The Hacker News, 2026-08-31). QnWallpaper.exe then loads a malicious libcef.dll placed alongside it (DLL sideloading through a signed, trusted process) which decrypts an AES-encrypted ValleyRAT payload and hands it control via DllMain; the backdoor's own command-and-control configuration is stored as a reversed key:value string to defeat static string scanning (Kaspersky Securelist, 2026-08-31).
Runtime protections are read from the malware's own configuration and each can be switched on or off independently: marking the process critical (so killing it forces a system crash), injecting a watchdog into svchost that toggles its memory region from no-access to fully executable to relaunch the implant if interrupted, and enumerating open windows to detect security or traffic-analysis tooling before proceeding; a fourth resilience mechanism (restarting the backdoor on an unhandled exception) is always active regardless of that configuration (Kaspersky Securelist, 2026-08-31). Spyware functions run through DirectInput8 hooks for keystroke capture and a separate clipboard-capture routine, both writing collected data to disk; on operator command the backdoor can pull and execute additional modules, using process hollowing into svchost when a module arrives as raw shellcode. Kaspersky's account of this specific campaign is based on one installer submitted by a customer, and its report stops short of attaching a victim count to this adware-distribution route; separately, and across all of 2026 rather than this campaign alone, Kaspersky recorded over 100,000 detections of ValleyRAT and associated malware affecting more than 1,500 unique users, concentrated in China and India (The Hacker News, 2026-08-31). Kaspersky attributes the campaign to Silver Fox, an established ValleyRAT operator, on geography and payload grounds (Kaspersky Securelist, 2026-08-31). DLL sideloading through signed, legitimate software is an established part of Silver Fox's toolkit, previously documented by Cato Networks against a Japanese manufacturer roughly five weeks earlier (The Hacker News, 2026-08-31). That campaign postdates a June 2026 Chinese police crackdown that arrested 67 people linked to Silver Fox across five provinces, evidence the group's operations continued despite the arrests; this QN Wallpaper campaign's own timing is not independently established beyond Kaspersky's 2026-08-31 publication date, so it cannot be dated relative to the arrests with the same confidence (Risky Bulletin, 2026-06-17).
Triage: genuine Chromium Embedded Framework processes (many legitimate desktop apps embed CEF) load libcef.dll from their own install directory and never inject code into svchost that toggles between no-access and executable memory states; that combination (a wallpaper or adware-class binary invoking CEF at all, paired with the svchost memory-protection change) is what separates this chain from ordinary CEF usage when that optional watchdog is present in the sample.
Over the course of 2026, we detected the ValleyRAT backdoor and its associated malware more than 100,000 times, with more than 1500 unique users affected, primarily in China and India.
After unpacking, the installer uses the DisableAntiSpyware registry key to disable Windows Defender and then launches QnWallpaper.exe.
This attack geography, combined with the use of the ValleyRAT backdoor, points to Silver Fox, a known operator of this malware family, as the likely group behind the campaign.
When the logged-in user lacks administrator rights, the malware relaunches itself with runas to acquire them.
Restarting on an unhandled exception. This protection mechanism is always active, regardless of the backdoor’s configuration.
Arrests took place across five provinces and targeted everyone from developers to phishing site operators and various affiliates.