ValleyRAT backdoor in fake adware installer

A client requested analysis of a file with the MD5 hash c24e99f9437feacaa63766a3cde3fe3d. Researchers at Kaspersky, who authored the source report, initially classified it as adware but discovered it delivered the ValleyRAT backdoor.

Attackers are distributing this backdoor under the guise of adware. They may have chosen this method because the adware was signed by its developer. Users often manually add such applications to security exclusions to prevent their useful features from being blocked.

The sample's advertising functionality does not work. Instead, it triggers an infection chain.

Malicious installer

The analyzed file is an installer. Its actions vary based on a two-letter suffix in the file name, a tactic likely designed to divert user attention. Regardless of the file name, it deploys a modified version of the Chinese desktop wallpaper management tool QN Wallpaper and adds it to autorun registry entries.

The original QN Wallpaper is genuine adware that delivers bundled partner apps and displays ads. In this case, attackers use it for DLL sideloading. This technique allows malicious code to run under the guise of a signed process via a malicious DLL.

The tool's modules and malicious components are unpacked to C:Program Files\QNWallpaper\5.4.0.1662\<random string>. After unpacking, the installer uses the DisableAntiSpyware registry key to disable Windows Defender and then launches QnWallpaper.exe.

DLL Sideloading via libcef.dll

The QnWallpaper.exe process depends on libcef.dll. QnWallpaper.exe also launches QnwPlayer.exe, which likewise calls libcef.dll. The wallpaper tools do not function correctly because functions exported from the malicious libcef.dll are put into an infinite sleep. A backup function loads necessary functions from the original library if it can be found on the system.

Malicious functionality in libcef.dll is invoked by a call to DllMain, which runs automatically when the library loads. The library also contains a function named RunDLL that initiates malicious code, though QnWallpaper never calls it. Researchers suspect the attackers intended to invoke it manually via rundll32 or with a separate executable.

Running the malicious code

When loaded, code ensures QnWallpaper.exe persists at startup by adding a file extension association and dropping a file in the startup folder. A chain of wrapper functions eventually calls the main malicious function, referred to by researchers as mw_entry.

This function checks if the current user is in the Administrators group and which process the DLL is running inside. If the user is not an administrator, the program attempts to obtain privileges using the runas utility.

With administrator privileges, the code selects a payload based on the host process:

Both payloads are AES-encrypted DLLs containing the ValleyRAT backdoor. They differ only in their configuration, specifically their command-and-control (C2) server addresses. After decryption, libcef.dll checks the PE file's magic signatures. If valid, it loads the payload into memory and hands control to the backdoor.

ValleyRAT capabilities

ValleyRAT begins by parsing its obfuscated configuration, which is a single string written in reverse order. It restores the correct character order and reads key values.

The backdoor employs several process protection techniques. Some are configurable, others are always active. Configurable options include injecting code into svchost to restart the backdoor if interrupted and marking its own process as critical, which triggers a system crash if terminated. A restart-on-exception mechanism is always active.

ValleyRAT has spyware functions. It tracks keystrokes and the focused window using the DirectInput8 library. It also captures clipboard contents, saving all collected data to a file.

If a specific configuration key (ll) is set to 1, the backdoor periodically checks for active windows belonging to analysis tools like process or traffic monitors.

The backdoor collects extensive system information on command. It can perform typical remote access trojan actions like rebooting or shutting down the computer, taking screenshots, wiping logs, updating C2 addresses, and downloading additional modules.

Module-loading functionality is versatile. Upon command with a link, it downloads and executes a file from either its C2 server or a third-party address. Modules can be dynamic libraries or shellcode. For shellcode, it uses process hollowing with svchost. For libraries, it loads the PE file, calls DllMain, searches for an exported Main function, calls it, and then unloads the library.

Targets and attribution

Kaspersky detected ValleyRAT and associated malware more than 100,000 times over the course of 2026. More than 1500 unique users were affected, primarily in China and India.

This attack geography and the use of ValleyRAT point to the known threat actor Silver Fox as the likely group behind the campaign. The backdoor is capable of collecting sensitive data like keystrokes and clipboard contents.