# ValleyRAT via Fake Huorong AV Site — Silver Fox APT DLL Sideloading, Winos4.0 Framework, Encrypted Shellcode Persistence

> Malwarebytes identified a campaign by Silver Fox APT distributing ValleyRAT (Winos4.0 framework) via a typosquatted Huorong Security antivirus website (huoronga[.]com). The trojanized NSIS installer uses DLL sideloading (WavesSvc64.exe loading malicious DuiLib_u.dll) to execute encrypted shellcode from box.ini in memory. Persistence via Windows Defender exclusions and scheduled tasks. Full-featured RAT with keylogging, process injection, credential theft, and modular plugin architecture. C2 at 161.248.87.250:443 using custom binary protocol. ProcessKiller module targets security software including the impersonated Huorong product.

- **Published:** 2026-02-24T17:42:00Z
- **Last reviewed:** 2026-02-24T17:42:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0138
- **ID:** TL-2026-0138
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** MONITORING
- **Actor:** Silver Fox APT (China)
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Malwarebytes Threat Intelligence identified a sophisticated campaign by Silver Fox APT, a Chinese-speaking threat group, distributing ValleyRAT through a convincing impersonation of Huorong Security (火绒), a popular free antivirus product developed by Beijing Huorong Network Technology Co., Ltd. widely used across mainland China.

The attackers registered multiple typosquatted domains including huoronga[.]com (extra 'a'), huorongcn[.]com, huorongh[.]com, huorongpc[.]com, and huorongs[.]com as near-perfect imitations of the legitimate huorong.cn. The fake sites are convincing enough that most visitors would have no reason to suspect compromise. Visitors arriving via search engine poisoning or phishing links click the download button, which routes through an intermediary domain (hndqiuebgibuiwqdhr[.]cyou) before the payload is served from Cloudflare R2 storage (pub-b7ce0512b9744e2db68f993e355a03f9.r2[.]dev) — a legitimate cloud service chosen for trusted reputation. The file is named BR火绒445.zip, using the Chinese name for Huorong.

The ZIP contains a trojanized NSIS installer (Nullsoft Scriptable Install System). When executed, it drops a desktop shortcut named 火绒.lnk (Huorong.lnk) reinforcing the security software illusion. It extracts a cluster of files into the user's Temp directory including genuine supporting libraries (FFmpeg multimedia DLLs, a file posing as a .NET repair tool, a Huorong diagnostic utility mimic) alongside the malicious components: WavesSvc64.exe (main loader disguised as Waves audio service process), DuiLib_u.dll (hijacked DirectUI library for DLL sideloading), and box.ini (encrypted shellcode).

The core technique is DLL sideloading. WavesSvc64.exe appears legitimate with a PDB path referencing a gaming application code directory, so Windows loads it without complaint. Windows automatically loads DuiLib_u.dll alongside it, which reads encrypted shellcode from box.ini, decrypts it, and executes it directly in memory. This shellcode-based chain is consistent with the Catena loader pattern documented by Rapid7, where signed or legitimate-looking executables bundle attack code in .ini configuration files and use reflective injection with minimal forensic footprint.

Persistence is methodical: (1) The malware spawns PowerShell at high integrity level and instructs Windows Defender to ignore its persistence directory (AppData\Roaming\trvePath) and main process (WavesSvc64.exe) via Add-MpPreference exclusions. (2) It creates a scheduled task named Batteries (C:\Windows\Tasks\Batteries.job) that launches WavesSvc64.exe /run from the persistence directory on every boot, reapplies Defender exclusions, and reconnects to C2. (3) For signature evasion, the malware deletes and re-writes WavesSvc64.exe, DuiLib_u.dll, libexpat.dll, box.ini, and vcruntime140.dll during execution. (4) Configuration data including the encoded C2 domain yandibaiji0203[.]com is stored in registry at HKCU\SOFTWARE\IpDates_info, with secondary encrypted binary data at HKCU\Console\0\451b464b7a6c2ced348c1866b59c362e.

Anti-analysis defenses include debugger detection via window title checks, VM detection probing BIOS version, display adapters, and VirtualBox registry keys, memory and disk capacity checks, and locale/language verification as geofencing to confirm Chinese-language systems before full deployment.

The Winos4.0 stager connects to C2 at 161.248.87.250 over TCP port 443 using a custom binary protocol (not standard TLS/HTTPS). IDS alerts triggered for Winos4.0 CnC login, server-response messages (ET SIDs 2052875, 2059975), and ProcessKiller C2 initialization (ET SID 2052262). C2 traffic originates from rundll32.exe executed without typical DLL,Export arguments — a high-confidence anomaly.

Sandbox analysis extracted multiple WinosStager plugin DLLs from the rundll32 process, confirming the modular architecture. Capabilities are downloaded on demand rather than bundled in a monolithic binary. Confirmed behaviors include: keylogging via system-wide keyboard hook (SetWindowsHookExW in rundll32), process injection (suspended process creation + memory writes), credential access (registry keys + browser cookie files), system reconnaissance (hostname, username, keyboard layout, locale, processes, physical drives), RWX memory regions in rundll32 for in-memory execution, and self-cleanup deleting 10+ files to obstruct forensic recovery.

The ProcessKiller component is particularly concerning — it targets security software from Qihoo 360, Huorong, Tencent, and Kingsoft. The irony is stark: the malware impersonates Huorong as a lure while having a module specifically designed to kill Huorong's actual security processes.

The ValleyRAT builder was publicly leaked on GitHub in March 2025, lowering the barrier to entry. Researchers identified approximately 6,000 related samples between November 2024 and November 2025, with 85% appearing in the latter half. Previous Silver Fox lures included QQ Browser, LetsVPN, and gaming applications. The mutex string '2026. 2. 5' indicates this specific build was compiled around February 5, 2026.

## MITRE ATT&CK

- T1189 Drive-by Compromise
- T1059.001 PowerShell
- T1204.002 Malicious File
- T1569.002 Service Execution
- T1053.005 Scheduled Task
- T1574.001 DLL
- T1685 Disable or Modify Tools
- T1027 Obfuscated Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1218.011 Rundll32
- T1070.004 File Deletion
- T1497.001 System Checks
- T1140 Deobfuscate/Decode Files or Information
- T1112 Modify Registry
- T1555 Credentials from Password Stores
- T1056.001 Keylogging
- T1082 System Information Discovery
- T1057 Process Discovery
- T1033 System Owner/User Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1105 Ingress Tool Transfer
- T1055 Process Injection
- T1489 Service Stop

## Sources

- [Malwarebytes: Fake Huorong security site infects users with ValleyRAT](https://www.malwarebytes.com/blog/scams/2026/02/huorong)
- [MITRE ATT&CK — DLL Side-Loading T1574.002](https://attack.mitre.org/techniques/T1574/002/)
- [MITRE ATT&CK — Scheduled Task T1053.005](https://attack.mitre.org/techniques/T1053/005/)
- [Rapid7 — Catena Loader Pattern Analysis](https://www.rapid7.com/)
- [Emerging Threats — Winos4.0 CnC Signatures (ET SID 2052875, 2059975, 2052262)](https://rules.emergingthreats.net/)
- [Huorong Security — Official Website (legitimate)](https://www.huorong.cn/)
- [Malwarebytes — ValleyRAT/Winos4.0 Framework Documentation](https://www.malwarebytes.com/blog/threats/remote-access-trojan-rat)
- [Cloudflare R2 — Legitimate Cloud Storage Abused for Payload Delivery](https://developers.cloudflare.com/r2/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0138