ValleyRAT via Fake Huorong AV Site — Silver Fox APT DLL Sideloading, Winos4.0 Framework, Encrypted Shellcode Persistence — Threadlinqs Intelligence
As of 2026-05-30, ValleyRAT via Fake Huorong AV Site — Silver Fox APT DLL Sideloading, Winos4.0 Framework, Encrypted Shellcode Persistence is a high-severity malware threat attributed to Silver Fox APT (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 24 indicators of compromise.
Threat ID: TL-2026-0138 · Severity: HIGH · Status: MONITORING · Category: MALWARE
Attribution: Silver Fox APT · China · ESPIONAGE
Malwarebytes identified a campaign by Silver Fox APT distributing ValleyRAT (Winos4.0 framework) via a typosquatted Huorong Security antivirus website (huoronga[.]com). The trojanized NSIS installer
Malwarebytes Threat Intelligence identified a sophisticated campaign by Silver Fox APT, a Chinese-speaking threat group, distributing ValleyRAT through a convincing impersonation of Huorong Security (火绒), a popular free antivirus product developed by Beijing Huorong Network Technology Co., Ltd. widely used across mainland China.
The attackers registered multiple typosquatted domains including huoronga[.]com (extra 'a'), huorongcn[.]com, huorongh[.]com, huorongpc[.]com, and huorongs[.]com as near-perfect imitations of the legitimate huorong.cn. The fake sites are convincing enough that most visitors would have no reason to suspect compromise. Visitors arriving via search engine poisoning or phishing links click the download button, which routes through an intermediary domain (hndqiuebgibuiwqdhr[.]cyou) before the payload is served from Cloudflare R2 storage (pub-b7ce0512b9744e2db68f993e355a03f9.r2[.]dev) — a legitimate cloud service chosen for trusted reputation. The file is named BR火绒445.zip, using the Chinese name for Huorong.
The ZIP contains a trojanized NSIS installer (Nullsoft Scriptable Install System). When executed, it drops a desktop shortcut named 火绒.lnk (Huorong.lnk) reinforcing the security software illusion. It extracts a cluster of files into the user's Temp directory including genuine supporting libraries (FFmpeg multimedia DLLs, a file posing as a .NET repair tool, a Huorong diagnostic utility mimic) alongside the malicious components: WavesSvc64.exe (main loader disguised as Waves audio service process), DuiLib_u.dll (hijacked DirectUI library for DLL sideloading), and box.ini (encrypted shellcode).
The core technique is DLL sideloading. WavesSvc64.exe appears legitimate with a PDB path referencing a gaming application code directory, so Windows loads it without complaint. Windows automatically loads DuiLib_u.dll alongside it, which reads encrypted shellcode from box.ini, decrypts it, and executes it directly in memory. This shellcode-based chain is consistent with the Catena loader pattern documented by Rapid7, where signed or legitimate-looking executables bundle attack code in .ini configuration files and use reflective injection with minimal forensic footprint.
Persistence is methodical: (1) The malware spawns PowerShell at high integrity level and instructs Windows Defender to ignore its persistence directory (AppData\Roaming rvePath) and main process (WavesSvc64.exe) via Add-MpPreference exclusions. (2) It creates a scheduled task named Batteries (C:\Windows\Tasks\Batteries.job) that launches WavesSvc64.exe /run from the persistence directory on every boot, reapplies Defender exclusions, and reconnects to C2. (3) For signature evasion, the malware deletes and re-writes WavesSvc64.exe, DuiLib_u.dll, libexpat.dll, box.ini, and vcruntime140.dll during execution. (4) Configuration data including the encoded C2 domain yandibaiji0203[.]com is stored in registry at HKCU\SOFTWARE\IpDates_info, with secondary encrypted binary data at HKCU\Console\0\451b464b7a6c2ced348c1866b59c362e.
Anti-analysis defenses include debugger detection via window title checks, VM detection probing BIOS version, display adapters, and VirtualBox registry keys, memory and disk capacity checks, and locale/language verification as geofencing to confirm Chinese-language systems before full deployment.
The Winos4.0 stager connects to C2 at 161.248.87.250 over TCP port 443 using a custom binary protocol (not standard TLS/HTTPS). IDS alerts triggered for Winos4.0 CnC login, server-response messages (ET SIDs 2052875, 2059975), and ProcessKiller C2 initialization (ET SID 2052262). C2 traffic originates from rundll32.exe executed without typical DLL,Export arguments — a high-confidence anomaly.
Sandbox analysis extracted multiple WinosStager plugin DLLs from the rundll32 process, confirming the modular architecture. Capabilities are downloaded on demand rather than bundled in a monolithic binary. Confirmed behaviors include: keylogging via
Weaknesses (CWE)
CWE-426, CWE-494
Target sectors: consumer, technology, government, defense
Target regions: China, East Asia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 24 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1189, T1059.001, T1204.002, T1569.002, T1053.005, T1574.002, T1053.005, T1574.002, T1562.001, T1027