Malwarebytes Threat Intelligence identified a sophisticated campaign by Silver Fox APT, a Chinese-speaking threat group, distributing ValleyRAT through a convincing impersonation of Huorong Security (火绒), a popular free antivirus product developed by Beijing Huorong Network Technology Co., Ltd. widely used across mainland China.

The attackers registered multiple typosquatted domains including huoronga[.]com (extra 'a'), huorongcn[.]com, huorongh[.]com, huorongpc[.]com, and huorongs[.]com as near-perfect imitations of the legitimate huorong.cn. The fake sites are convincing enough that most visitors would have no reason to suspect compromise. Visitors arriving via search engine poisoning or phishing links click the download button, which routes through an intermediary domain (hndqiuebgibuiwqdhr[.]cyou) before the payload is served from Cloudflare R2 storage (pub-b7ce0512b9744e2db68f993e355a03f9.r2[.]dev) — a legitimate cloud service chosen for trusted reputation. The file is named BR火绒445.zip, using the Chinese name for Huorong.

The ZIP contains a trojanized NSIS installer (Nullsoft Scriptable Install System). When executed, it drops a desktop shortcut named 火绒.lnk (Huorong.lnk) reinforcing the security software illusion. It extracts a cluster of files into the user's Temp directory including genuine supporting libraries (FFmpeg multimedia DLLs, a file posing as a .NET repair tool, a Huorong diagnostic utility mimic) alongside the malicious components: WavesSvc64.exe (main loader disguised as Waves audio service process), DuiLib_u.dll (hijacked DirectUI library for DLL sideloading), and box.ini (encrypted shellcode).

The core technique is DLL sideloading. WavesSvc64.exe appears legitimate with a PDB path referencing a gaming application code directory, so Windows loads it without complaint. Windows automatically loads DuiLib_u.dll alongside it, which reads encrypted shellcode from box.ini, decrypts it, and executes it directly in memory. This shellcode-based chain is consistent with the Catena loader pattern documented by Rapid7, where signed or legitimate-looking executables bundle attack code in .ini configuration files and use reflective injection with minimal forensic footprint.

Persistence is methodical: (1) The malware spawns PowerShell at high integrity level and instructs Windows Defender to ignore its persistence directory (AppData\Roaming rvePath) and main process (WavesSvc64.exe) via Add-MpPreference exclusions. (2) It creates a scheduled task named Batteries (C:\Windows\Tasks\Batteries.job) that launches WavesSvc64.exe /run from the persistence directory on every boot, reapplies Defender exclusions, and reconnects to C2. (3) For signature evasion, the malware deletes and re-writes WavesSvc64.exe, DuiLib_u.dll, libexpat.dll, box.ini, and vcruntime140.dll during execution. (4) Configuration data including the encoded C2 domain yandibaiji0203[.]com is stored in registry at HKCU\SOFTWARE\IpDates_info, with secondary encrypted binary data at HKCU\Console\0\451b464b7a6c2ced348c1866b59c362e.

Anti-analysis defenses include debugger detection via window title checks, VM detection probing BIOS version, display adapters, and VirtualBox registry keys, memory and disk capacity checks, and locale/language verification as geofencing to confirm Chinese-language systems before full deployment.

The Winos4.0 stager connects to C2 at 161.248.87.250 over TCP port 443 using a custom binary protocol (not standard TLS/HTTPS). IDS alerts triggered for Winos4.0 CnC login, server-response messages (ET SIDs 2052875, 2059975), and ProcessKiller C2 initialization (ET SID 2052262). C2 traffic originates from rundll32.exe executed without typical DLL,Export arguments — a high-confidence anomaly.

Sandbox analysis extracted multiple WinosStager plugin DLLs from the rundll32 process, confirming the modular architecture. Capabilities are downloaded on demand rather than bundled in a monolithic binary. Confirmed behaviors include: keylogging via system-wide keyboard hook (SetWindowsHookExW in rundll32), process injection (suspended process creation + memory writes), credential access (registry keys + browser cookie files), system reconnaissance (hostname, username, keyboard layout, locale, processes, physical drives), RWX memory regions in rundll32 for in-memory execution, and self-cleanup deleting 10+ files to obstruct forensic recovery.

The ProcessKiller component is particularly concerning — it targets security software from Qihoo 360, Huorong, Tencent, and Kingsoft. The irony is stark: the malware impersonates Huorong as a lure while having a module specifically designed to kill Huorong's actual security processes.

The ValleyRAT builder was publicly leaked on GitHub in March 2025, lowering the barrier to entry. Researchers identified approximately 6,000 related samples between November 2024 and November 2025, with 85% appearing in the latter half. Previous Silver Fox lures included QQ Browser, LetsVPN, and gaming applications. The mutex string '2026. 2. 5' indicates this specific build was compiled around February 5, 2026.