ValleyRAT doesn’t always need to disguise itself as a cracked game or a fake browser update. It can also hide behind something much more ordinary: an application that looks like adware and appears to serve a legitimate purpose.
Kaspersky’s latest analysis shows how this works. Researchers found a malicious installer that uses a modified version of QN Wallpaper, a legitimate Chinese desktop wallpaper application, to deliver the ValleyRAT backdoor while making the infection look like a normal software installation.
Researchers found a malicious installer that uses a modified version of QN Wallpaper, a legitimate Chinese desktop wallpaper application, to deliver the ValleyRAT backdoor while making the infection look like a normal software installation.
The interesting part is how the attackers make the first stages look harmless. The installer can present itself as software associated with DingTalk, Google Chrome or Tencent Meeting, depending on the filename, while quietly deploying the modified wallpaper application in the background.
That gives the victim something familiar to look at while the real work happens elsewhere. It’s a simple trick, but it removes one of the most obvious warning signs of a malware infection: the feeling that something unusual has just been installed.
Kaspersky originally received one of the samples because a customer wanted it classified as adware. An initial look at the file suggested exactly that, but suspicious network activity changed the picture and led researchers to examine the sample more closely. They found that the advertising component didn’t actually perform its supposed job. Instead, it started an infection chain that eventually loaded ValleyRAT.
“The original version of QN Wallpaper is genuine adware: on installation, it delivers bundled partner apps to the device and then displays ad banners to the user.” reads Kaspersky’s report. “In this case, however, the attackers use it to carry out DLL sideloading, a technique that allows malicious code to run under the guise of a signed process by way of a malicious DLL.”
That distinction matters because the attackers aren’t inventing a fake application from scratch. They’re abusing software that already looks legitimate and using its normal execution flow to load malicious code.
The technique is DLL sideloading. In simple terms, the attacker places a malicious DLL where a legitimate program expects to find a library, allowing the trusted application to load the attacker’s code.
Here, the relevant library is libcef.dll
. QN Wallpaper and its companion process load that library when they start, giving the attackers a convenient place to execute their own code under the name of a legitimate application.
The installer also creates persistence and disables Windows Defender through the DisableAntiSpyware
registry key before launching QnWallpaper.exe. That combination makes the infection considerably more serious than ordinary adware.
Once the malicious library runs, it checks whether the current user has administrator privileges. If necessary, it attempts to relaunch the process with elevated privileges before continuing with the next stage.
The actual ValleyRAT payload sits encrypted inside the infection chain. Depending on which legitimate process loads the malicious library, the backdoor comes from either a separate PeLoader
file or resources embedded in libcef.dll
.
The payloads use AES encryption and contain ValleyRAT as an encrypted DLL. Their configurations differ mainly in the command-and-control addresses they use, giving the operators more than one way to manage infected systems.
ValleyRAT then starts behaving like the backdoor it actually is. It reads its configuration, connects to its command-and-control infrastructure and prepares a range of functions that give an attacker control over the compromised machine.
The malware can collect keystrokes and clipboard contents, monitor the active window and gather detailed information about the infected system. That includes the hostname, IP addresses, Windows version, CPU information, available disk space, graphics adapter, language settings and other system details.
“The backdoor also has spyware functionality. While running, it tracks keystrokes and the currently focused window by using functions from the DirectInput8 library. It also captures clipboard contents.” continues the report. “All collected data is saved to a file on disk.”
The operator can also order the backdoor to take screenshots, reboot or shut down the machine, wipe logs, change its command-and-control addresses and download additional modules. ValleyRAT can retrieve those modules from either its own C2 infrastructure or a third-party address.
That last capability gives the attackers room to change what the malware does after the initial infection. They don’t need to put every capability into the first payload if they can download new components later.
The malware also takes steps to make itself harder to remove. Depending on its configuration, it can inject code into svchost.exe
so that the backdoor restarts if someone stops it. It can also mark its own process as critical, meaning that terminating it can trigger a system crash.
That’s not subtle, but it’s effective. The malware is essentially telling the defender that killing the process isn’t supposed to be a clean operation.
Kaspersky says ValleyRAT can detect security and traffic-analysis tools, while the campaign has been detected over 100,000 times in 2026, affecting more than 1,500 users, mainly in China and India. The activity is linked to Silver Fox, focused on both espionage and financial gain.
In July 2026, Cato CTRL documented a SilverFox campaign targeting a Japanese industrial manufacturer. The attack chain adds two previously undocumented DLL-sideloading hosts, two kernel drivers not previously associated with SilverFox, and a dual-layer recovery architecture that keeps ValleyRAT running even if defenders terminate individual components.
That broader activity puts the Kaspersky finding into perspective. The adware campaign isn’t an isolated curiosity. It fits a larger pattern in which Silver Fox uses legitimate software, familiar brands and trusted execution paths to get malicious code onto Windows systems and keep it there.
For defenders, blocking a known ValleyRAT file is not enough because the real risk is how the malware gets executed. A legitimate-looking application, signed component or familiar installer can become part of a malicious chain. Antivirus exclusions can make the problem worse by creating blind spots.
“This case is a clear example of how adware and affiliate networks can turn out to be far more dangerous than they appear. ValleyRAT is a sophisticated backdoor capable of collecting sensitive data such as keystrokes and clipboard contents, taking screenshots, and delivering additional malicious modules.” concludes the report. “The attackers exploited a well-known adware application to run the backdoor under the guise of a signed process, which complicates detection.”
Kaspersky recommends clear rules for third-party software, security awareness and avoiding suspicious applications or exclusions simply because a program asks for them. The malware does not need to look dangerous; it only needs to look legitimate enough that nobody questions why an ordinary application suddenly behaves like a backdoor.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, newsletter)