Fraudulent installer uses DLL sideloading to load ValleyRAT in QnWallpaper

A fraudulent installer that incorporates the ValleyRAT remote access trojan (also identified as Winos 4.0) has been detected as a signed version of a Chinese wallpaper program, according to the analysis shared by Kaspersky. The sample studied abrupts a chain of attack that takes advantage of a legitimate application - QN Wallpaper - to run malicious code within a signed process, deactivate protections and persist on the computer, leaving the machine completely controlled by the backdoor operator.

What happened, technically?. The installer delivers a modified copy of QnWallpaper.exe (the legitimate application) in a system folder and places a malicious library called libcef.dll. on the same route. When the signed executable loads your dependent library, Windows resolves and loads that local DLL in the context of the legitimate process: it's the technique known as DLL sideloading. With malicious DLL running inside a signed binary, many signs of confidence in protections may be weakened. Before the adware advertising part is activated, the installer modifies the record to set the DisableAntiSpyware key (disabling Microsoft Defender) and adds automatic start-up inputs. If the user does not have high privileges, the installer tries to relaunch using runes to obtain administrative permits. In addition, the backdoor can mark its process as critical, so any hasty termination causes a blue screen.

What skills has ValleyRAT. According to Kaspersky, ValleyRAT can capture pulsations, flip clipboard content, take screenshots and download additional modules, delivering the attacker with complete remote control over the compromised machine. These behaviors place malware as a multifunction back door aimed at exfiltering sensitive credentials and data.

Indicators and artifacts observed (confirmed facts). Kaspersky published several IoC extracted from the analyzed sample: MD5 hashes of files (c24e99f9... of the installer; 07dbbe2... of the malicious libcef.dll; 8a626d84... of another component), command and control servers in 103.45.66.18 (ports 441 / 442 / 443) and 192.253.225.173 (ports 6666 / 8888), and domains used in the chain as qnwallpaper [.] keansoft [.] cn and a legitimate resource of Tenicular. The observed installation route is also documented: C:\ Program Files\ QNWallpaper\ 5.4.0.1662\ and the creation of the DisableAntiSpyware key as evidence of attempts to disable defenses.

Attribution and scope (confirmed vs. estimated). Kaspersky attributes this variant to the group known as Silver Fox based on the geography of the attack, the choice of payload and the technique of abuse of legitimate applications - a tactic already previously observed in campaigns related to the group -. This attribution is the technical opinion of the supplier and is based on similarities with previous incidents, but, as in any public attribution, it is a reasoned estimate and not an absolute certainty. The report is based on a single installer submitted by a client; Kaspersky does not directly associate that installer to a specific number of victims in this campaign. Separately, aggregate data for the year show that Kaspersky detected more than 100,000 ValleyRAT-related detections in 2026, affecting more than 1,500 unique users, mainly in China and India - this figure corresponds to all ValleyRAT activity in 2026 and not only to the adware route described in this case.

Why this matters and who it affects. The technique exploits confidence in legitimate signatures and apparently harmless software (adware / partner bundles). It affects both private users who install programs of dubious origin and organizations that allow third-party software on working machines or that maintain exclusions on their antivirus. Since the sample marks the process as critical and deactive Defender, the remediation may require out-of-common procedures (safe start, offline cleaning or reinstallation), which increases the operational cost and risk of exfiltration of information before detection.

Specific measures recommended for users and managers. Based on the observed behaviour, these are practical and verifiable actions:

- For individual users: avoid installing dubious reputation software; never add to the no-checked antivirus exclusions lists; check the digital signature of an installer before running it; and monitor the typical installation folder cited (e.g. C:\ Program Files\ QNWallpaper\) and the presence of unexpected libcef.dll files.

- For security administrators and equipment: block and monitor the IoC provided (hashes and IP addresses), restrict the installation of unapproved software by white list policies, and audit Microsoft Defender settings to detect scriptures in the DisableAntiSpyware key. A couple of useful checks (PowerShell) would be to inspect the Defense policy key: Get-ItemProperty -Path'HKLM:\ SOFTWARE\ Policies\ Microsoft\ Windows Defender '-Name DisableAntiSpyware and list self-boot inputs with Autoruns or Get-CimInstance Win32 _ StartupCommand. It is also appropriate to detect suspicious processes that load a libcef.dll from non-standard routes and correlate digital signatures with valid certificates.

- In corporate networks: apply execution controls (AppLocker / WDAC), segment workstations and limit local privileges to prevent automatic elevations; deploy EDR with ability to detect DLL sideloading and behavior (creation of relevant registration keys, attempt to mark processes as critics). Keep known C2 lock lists and update detection rules with observed PIs and ports.

Resources and technical reading. The technique of DLL sideloading is documented in the framework of MITRE ATT & CK: https: / / attack.mitre.org / techniques / T1574 / 002 /. The options and risks of disabling Microsoft Defender and its management are explained in Microsoft documentation: https: / / learn.microsoft.com /. For more specific analysis and context on ValleyRAT and Silver Fox tactics, it is appropriate to consult the technical publications of specialized security providers.

Confirmed vs. uncertain. Confirmed: the analyzed sample uses QnWallpaper signed to load a malicious libcef.dll (DLL sideloading); the installer modifies DisableAntiSpyware and creates persistence; the hashes and C2 cited were observed by Kaspersky. Dear / attribution: the link with Silver Fox is based on patterns and context, but it is an evaluation of the researcher. Uncertain: the actual number of victims affected by this route and if there are additional variants active in parallel not detected by Kaspersky in this spot finding.

The practical lesson is clear: "harmless" applications that show advertising or install supplements can be vectors of much more serious attacks when attackers modify legitimate components to run malicious code in a context of trust. Blinding installation processes, avoiding reckless exclusions in safety tools and monitoring signs of sideloading are concrete steps that reduce exposure to such campaigns.