Skip to navigation

Threat reportMalwareTL-2026-2256

ValleyRAT (Winos 4.0) Backdoor Hides in Signed QN Wallpaper Installer via DLL Sideloading

highACTIVE

Silver Fox is distributing the ValleyRAT (Winos 4.0) backdoor disguised as the QN Wallpaper adware tool. A signed QnWallpaper.exe installer sideloads a malicious libcef.dll, disables Windows Defender via registry modification, and installs a backdoor capable of keylogging, clipboard theft, screenshot capture, and loading additional malicious modules. First disclosed .

Key facts for ValleyRAT signed installer sideload

IdentifiersTL-2026-2256
Also known asWinos 4.0, Winos, Trojanized QN Wallpaper
SeverityHIGH
First disclosed
Exploitation statusExploited in the wild
Affected productsMicrosoft Windows; Keansoft QN Wallpaper
AttributionVoid Arachne (medium confidence)
Nation-state nexusChina
MalwareMariposa, ValleyRAT, Winos, Winos 4.0
ToolsBootRepair.sys / EnPortv.sys, WatchDog Antimalware driver (amsdk.sys)
MITRE ATT&CK techniquesT1055 Process Injection, T1056 Input Capture, T1057 Process Discovery, T1082 System Information Discovery, T1112 Modify Registry, T1113 Screen Capture, T1123 Audio Capture, T1129 Shared Modules, T1195 Supply Chain Compromise, T1204 User Execution, T1547 Boot or Logon Autostart Execution, T1548 Abuse Elevation Control Mechanism and 5 more in the attack flow
MotivationESPIONAGE
Target sectorsconsumer, government administration, finance, health, manufacturing
Target regionschina, india, russia, japan, malaysia, taiwan
Detection rules9 (1 shown free)
Sources10 cited sources

Detection coverage for ValleyRAT signed installer sideload

As of 2026-08-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2256 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Trojanized QnWallpaper.exe Sideloading Malicious libcef.dll

Detects the signed QnWallpaper.exe (v5.4.0.1662) installer/executable being launched from the QNWallpaper install directory and subsequently loading a libcef.dll image that is not part of a legitimate Chromium Embedded Framework install — the DLL sideload technique used to smuggle the ValleyRAT (Winos 4.0) loader stage under a validly signed binary. Also matches on known trojanized installer/DLL hashes.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1195, T1204, T1129, T1574
  • Data sources: sysmon, windows_security, microsoft_defender_for_endpoint
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=7)
| eval event_type=if(EventCode=1, "process_create", "image_load")
| where (event_type="process_create" AND match(lower(Image), "qnwallpaper\.exe$") AND match(lower(Image), "qnwallpaper\\\\5\.4\.0\.1662"))
   OR (event_type="image_load" AND match(lower(Image), "qnwallpaper\.exe$") AND match(lower(ImageLoaded), "libcef\.dll$") AND NOT match(lower(ImageLoaded), "chrome|cef\\\\\d|program files\\\\google"))
   OR (Hash="MD5=c24e99f9437feacaa63766a3cde3fe3d" OR Hash="MD5=07ddbbe2c71c45577a7a4fbcdba0df91" OR Hash="MD5=8a626d844943da3456b044f38deae3a2")
| stats earliest(_time) as first_seen, latest(_time) as last_seen, count by Computer, User, Image, ImageLoaded, Hashes, event_type
| where count > 0

Microsoft KQL

let TrojanHashes = dynamic(["c24e99f9437feacaa63766a3cde3fe3d","07ddbbe2c71c45577a7a4fbcdba0df91","8a626d844943da3456b044f38deae3a2"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FolderPath has_cs @"QNWallpaper\5.4.0.1662" and FileName =~ "QnWallpaper.exe"
| project Timestamp, DeviceName, AccountName, FolderPath, FileName, MD5, InitiatingProcessFileName
| union (
    DeviceImageLoadEvents
    | where Timestamp > ago(24h)
    | where InitiatingProcessFileName =~ "QnWallpaper.exe" and FileName =~ "libcef.dll"
    | where not(FolderPath has "Chrome") and not(FolderPath has "CEF")
    | project Timestamp, DeviceName, AccountName, FolderPath, FileName, MD5, InitiatingProcessFileName
)
| union (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where MD5 in (TrojanHashes)
    | project Timestamp, DeviceName, AccountName, FolderPath, FileName, MD5, InitiatingProcessFileName
)

Sigma

title: Trojanized QnWallpaper.exe Sideloading Malicious libcef.dll (ValleyRAT/Winos 4.0)
id: 7c1e4a2e-3b5d-4f6a-9c8e-2a1d5f7b9c3e
status: experimental
description: Detects the signed QnWallpaper.exe installer loading a non-legitimate libcef.dll from the QNWallpaper 5.4.0.1662 install directory, the DLL sideload technique used to launch the ValleyRAT (Winos 4.0) loader stage.
references:
    - https://thehackernews.com/2026/08/valleyrat-backdoor-hides-in-signed.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-31
tags:
    - attack.initial-access
    - attack.t1195
    - attack.execution
    - attack.t1204
    - attack.t1129
    - attack.defense-evasion
    - attack.t1574.002
    - attack.tool.valleyrat
    - attack.tool.winos
detection:
    selection_process:
        Image|endswith: '\QnWallpaper.exe'
        Image|contains: 'QNWallpaper\5.4.0.1662'
    selection_sideload:
        Image|endswith: '\QnWallpaper.exe'
        ImageLoaded|endswith: '\libcef.dll'
    filter_legit_cef:
        ImageLoaded|contains:
            - '\Google\Chrome\'
            - '\CEF\'
    selection_hash:
        Hashes|contains:
            - 'c24e99f9437feacaa63766a3cde3fe3d'
            - '07ddbbe2c71c45577a7a4fbcdba0df91'
            - '8a626d844943da3456b044f38deae3a2'
    condition: selection_process or (selection_sideload and not filter_legit_cef) or selection_hash
falsepositives:
    - A legitimate, unmodified QN Wallpaper install where libcef.dll ships as a genuine bundled CEF component (rare outside this trojanized redistribution)
level: high
logsource:
    category: image_load
    product: windows

Known false positives:

  • An untampered, legitimately signed QN Wallpaper installation where libcef.dll is a genuine CEF component shipped by the vendor — rare given this is a trojanized redistribution channel, but verify signature chain and file hash before escalating

Tuning notes: If QN Wallpaper is not an approved application in the environment, convert this to a blanket block/alert on any execution of QnWallpaper.exe. Extend the trojan-hash allowlist as new campaign samples are published, and add a dedicated rule for the 2025 PNGPlug libcef.dll sideload variant referenced in research to catch shared-infrastructure reuse.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Trojanized [indicator] Sideloading Malicious [indicator] · unlock with TL Creds
  • ValleyRAT Post-Exploitation: Defender Tamper, Autorun Persistence, and Kernel Rootkit Registry Keys · unlock with TL Creds
  • ValleyRAT C2 Beaconing to Non-Standard-Port Encrypted Channels · unlock with TL Creds
  • Trojanized [indicator] Sideloading Malicious [indicator] · unlock with TL Creds
  • ValleyRAT Post-Exploitation: Defender Tamper, Autorun Persistence, and Kernel Rootkit Registry Keys · unlock with TL Creds
  • ValleyRAT C2 Beaconing to Non-Standard-Port Encrypted Channels · unlock with TL Creds
  • ValleyRAT Post-Exploitation: Defender Tamper, Autorun Persistence, and Kernel Rootkit Registry Keys · unlock with TL Creds
  • ValleyRAT C2 Beaconing to Non-Standard-Port Encrypted Channels · unlock with TL Creds

Indicators of compromise for ValleyRAT signed installer sideload

As of 2026-08-31, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-2256.

Sample indicators (3 of 17)

  • IP address: 103.45.66[.]18
  • Domain: qnwallpaper[.]keansoft[.]cn
  • File hash: c24e99f9437feacaa63766a3cde3fe3d

Defanged, TLP:CLEAR. Full set of 17 indicators: unlock with TL Creds.

17 indicators of compromise · unlock with TL Creds. Compare plans

How ValleyRAT signed installer sideload works

Kaspersky recorded over 100,000 detections affecting more than 1,500 unique users, mostly in China and India, in 2026.

Kaspersky telemetry has identified a wave of ValleyRAT (also tracked as Winos 4.0) distribution disguised as the legitimate Chinese desktop-customization adware application QN Wallpaper. Attackers repackaged the adware installer so that its signed executable, QnWallpaper.exe, is placed alongside a malicious libcef.dll in the same install directory (C:\Program Files\QNWallpaper\5.4.0.1662\); when the signed process starts it resolves and loads the attacker's DLL from that directory instead of (or in addition to) any legitimate Chromium Embedded Framework component, executing the backdoor's loader stage under the umbrella of a validly signed binary. The loader disables Windows Defender by setting the DisableAntiSpyware registry value, adds itself to system autorun so it survives reboot, and attempts privilege escalation via the `runas` verb when the current user is not an administrator. The delivery site (qnwallpaper[.]keansoft[.]cn) fronts the trojanized adware download, while a Tencent Meeting URL (meeting[.]tencent[.]com) is used as a decoy landing page during the infection flow.

Once installed, ValleyRAT/Winos 4.0 behaves as a full-featured, plugin-based backdoor: it harvests keystrokes and clipboard contents, captures screenshots, can reboot or shut down the host, and downloads/loads additional malicious modules on operator command. To resist takedown it flags its own process as critical to the OS, so any attempt to forcibly terminate it triggers a Windows blue-screen-of-death rather than allowing the process to be killed cleanly. Kaspersky recorded more than 100,000 detections of ValleyRAT and associated malware affecting over 1,500 unique users during 2026, concentrated in China and India, consistent with an opportunistic, adware-bundled distribution model rather than narrowly targeted spear-phishing.

ValleyRAT/Winos 4.0 is the signature backdoor of the Chinese-speaking cybercrime/espionage cluster tracked as Silver Fox (aka SwimSnake, The Great Thief of Valley, UTG-Q-1000, Void Arachne), an evolution of legacy Gh0st RAT-derived tooling built around a modular plugin architecture. A leaked builder (compiled March 2025) exposed the backdoor's internals: 19 paired 32/64-bit main plugins covering beaconing, keylogging, audio/video/screen capture, remote terminal, file/registry management, scheduled-task persistence, proxy tunneling, a DDoS stress-test module, and credential theft from Chinese applications (QQ, WeChat, Telegram) and browsers. A separate Driver Plugin embeds a 64-bit kernel-mode rootkit derived from the public 'Hidden' rootkit project that hides registry keys/files, protects the malware's process, injects shellcode via APC queuing, and force-deletes 50+ competing EDR/AV drivers (including Kaspersky, Qihoo 360, Huorong, and Tencent security products) at startup. Related Silver Fox campaigns documented in the same period show the group's rapid tooling evolution: abuse of a Microsoft-signed WatchDog Antimalware driver (amsdk.sys) to kill PP/PPL-protected security processes (BYOVD), a three-driver BYOVD chain (adding BootRepair.sys and EnPortv.sys) against a Japanese industrial manufacturer via trusted-software hijacking (ConvertToPDF.exe/PDFDirect.exe sideloading), and tax-themed phishing lures against Indian and Russian organizations that deliver a new ValleyRAT plugin loading a previously undocumented Python-based backdoor, ABCDoor. This QN Wallpaper campaign reuses the DLL-sideload technique previously seen in a 2025 PNGPlug loader campaign that also abused libcef.dll, suggesting shared tooling/infrastructure across the actor's distribution chains.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1055 Process Injection; T1574 Hijack Execution Flow

Collection

T1056 Input Capture; T1113 Screen Capture; T1123 Audio Capture

Discovery

T1057 Process Discovery; T1082 System Information Discovery

defense-impairment

T1112 Modify Registry; T1685 Disable or Modify Tools

Execution

T1129 Shared Modules

Initial Access

T1195 Supply Chain Compromise

execution

T1204 User Execution

Persistence

T1547 Boot or Logon Autostart Execution

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Credential Access

T1555 Credentials from Password Stores

Command and Control

T1571 Non-Standard Port; T1573 Encrypted Channel

Remediation for ValleyRAT signed installer sideload

Immediate actions

  • Block the confirmed C2 IPs 103.45.66.18 (TCP 441/442/443) and 192.253.225.173 (TCP 6666/8888) and the delivery domain qnwallpaper[.]keansoft[.]cn at perimeter/proxy/DNS
  • Hunt for QnWallpaper.exe co-located with libcef.dll outside a legitimate Chromium Embedded Framework install, and for the install path C:\Program Files\QNWallpaper\5.4.0.1662\
  • Audit endpoints for an unauthorized DisableAntiSpyware registry value under the Windows Defender policy keys and revert it
  • Isolate and re-image any host where the malicious process could not be terminated (critical-process flag triggering BSOD is a strong compromise indicator)

Workarounds

  • Block or alert on any non-Chromium-Embedded-Framework process loading a file named libcef.dll
  • Monitor for processes that set themselves as critical (bugcheck-on-termination) as a high-confidence indicator of anti-kill malware

Longer-term hardening

  • Deploy application allowlisting / code-integrity policy to block unauthorized DLLs loading into signed third-party executables (DLL sideloading defense)
  • Enable Microsoft Defender tamper protection and attack-surface-reduction rules that block unauthorized changes to security-product registry settings
  • Deploy and keep current the Microsoft vulnerable-driver blocklist to close the BYOVD path (amsdk.sys, BootRepair.sys, EnPortv.sys) this actor uses in related campaigns to disable EDR/AV
  • Restrict installation of adware/PUA-bundled software via endpoint/download policy given this actor's pattern of trojanizing legitimate consumer utilities

Affected and fixed versions

  • Microsoft — Windows
    Vulnerable versions: Windows 10; Windows 11
  • Keansoft — QN Wallpaper
    Vulnerable versions: 5.4.0.1662 (trojanized redistribution)

Timeline of ValleyRAT signed installer sideload

  • The locked-ioc-16/locked-ioc-17 32-bit PE builder used across the malware family is compiled; ~85% of ~6,000 later-observed samples emerge within six months of this build, per Check Point Research.
  • Silver Fox is observed exploiting a Microsoft-signed locked-ioc-3 to terminate PP/PPL-protected security processes before deploying locked-ioc-16.
  • Kaspersky detects a wave of tax-authority-themed phishing emails targeting Indian users that deliver locked-ioc-16, attributed to Silver Fox.
  • A similar tax-themed campaign begins targeting Russian organizations; the delivered locked-ioc-16 plugin loads a previously undocumented Python-based backdoor codenamed ABCDoor.
  • The ABCDoor/tax-themed India-Russia campaign is publicly reported.
  • Cato Networks documents Silver Fox targeting a Japanese industrial manufacturer with an updated attack chain: two new DLL-sideloading hosts (ConvertToPDF.exe, PDFDirect.exe) and two new kernel drivers (BootRepair.sys, EnPortv.sys) used to disable security tooling before deploying locked-ioc-16.
  • Kaspersky/The Hacker News report the QN Wallpaper-disguised locked-ioc-16 campaign: a signed locked-ioc-13 sideloads a malicious locked-ioc-15, disables Windows Defender, and installs the locked-ioc-16 backdoor; 100,000+ detections and 1,500+ unique victims recorded in 2026, mostly in China and India.

Sources cited for ValleyRAT signed installer sideload

More from Void Arachne

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 10 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats