A customer sent Kaspersky a file and asked for it to be added to the detection database. The analysts logged it as adware and moved on, until its network traffic looked wrong. The advertising code inside it does not even work. What it actually does is install a full remote access backdoor called ValleyRAT.
That disguise is the interesting part. Adware is the software category users deliberately wave through.
Because the wallpaper tool at the centre of this chain is genuine adware signed by its developer, plenty of people install it on purpose and then add it to their security product's exclusion list so its features are not blocked. The attackers get a signed process, a permitted directory and a user who has already told their antivirus to look away.
Three decoys and one wallpaper tool
The installer behaves differently depending on a two-letter code in its filename. FS_SETUP_DD_173.exe installs DingTalk, the workplace collaboration app. FS_SETUP_GG_173.exe installs Google Chrome. FS_SETUP_HY_173.exe opens the Tencent Meeting download page. All three exist to give the user something to look at.
Whichever one runs, it unpacks a modified build of QN Wallpaper, a Chinese desktop wallpaper manager, into a randomly named folder under Program Files and adds it to the registry's autorun entries. It also writes the DisableAntiSpyware registry key to switch off Windows Defender.
The trick that follows is DLL sideloading, where a legitimate signed program is made to load a malicious library sitting next to it. QnWallpaper.exe and QnwPlayer.exe both depend on libcef.dll, so the attackers supplied their own. Its malicious code runs from DllMain the moment the library loads, and the functions the real application expects are put into an infinite sleep, which is why the wallpaper app never quite works. If the current user is not an administrator, the code relaunches itself through runas to ask for privileges. The backdoor itself arrives AES-encrypted, either from a file named PeLoader or from the library's own resources, depending on which process loaded it, and is decrypted straight into memory.
A keylogger that blue-screens the machine if you kill it
ValleyRAT reads its configuration from a string the operators wrote backwards, then settles in. It records keystrokes and the title of whatever window has focus, captures the clipboard, and writes it all to disk for collection. On command it takes screenshots, reboots or shuts down the host, wipes logs, swaps its own command and control addresses, and downloads further modules, running shellcode by hollowing out an svchost process or loading DLLs directly into its own.
Its self-protection is unusually aggressive. It injects a routine into svchost whose only job is to restart the backdoor if it stops, it restarts itself on any unhandled exception, and, if configured to, it marks its own process as critical so that terminating it triggers a blue screen of death.
Who is on the other end
Across 2026 Kaspersky detected ValleyRAT and its associated malware more than 100,000 times, affecting more than 1,500 unique users, primarily in China and India. On that geography and the malware family, the researchers name Silver Fox as the likely operator, a group they describe as motivated by both cyberespionage and financial gain. IntelFusions previously covered the same crew abusing a Microsoft-signed driver to disable security software in Japan.
Stop exempting nuisance software from scanning
The practical control here is a policy one. Questionable free tools do not belong on work devices, and nothing should be added to an antivirus exclusion list because it is noisy. On the detection side, watch for writes to the DisableAntiSpyware key, for libcef.dll loading from a path outside a browser or Electron application's own directory, and for user-level processes that survive being killed.
Pavel Bukhtenko published the analysis for Kaspersky's Securelist. Selected indicators, defanged: MD5 c24e99f9437feacaa63766a3cde3fe3d (installer), 07ddbbe2c71c45577a7a4fbcdba0df91 (malicious libcef.dll), and command and control at 103[.]45[.]66[.]18 on ports 441 to 443 and 192[.]253[.]225[.]173 on ports 6666 and 8888.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.