# ValleyRAT (Winos 4.0) Backdoor Hides in Signed QN Wallpaper Installer via DLL Sideloading

> Silver Fox is distributing the ValleyRAT (Winos 4.0) backdoor disguised as the QN Wallpaper adware tool. A signed QnWallpaper.exe installer sideloads a malicious libcef.dll, disables Windows Defender via registry modification, and installs a backdoor capable of keylogging, clipboard theft, screenshot capture, and loading additional malicious modules. Kaspersky recorded over 100,000 detections affecting more than 1,500 unique users, mostly in China and India, in 2026.

- **Published:** 2026-08-31T00:00:00Z
- **Last reviewed:** 2026-08-31T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2256
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-valleyrat-signed-installer-sideload-tl-2026-2256.webp?v=d4861c10 (Threadlinqs threat intel: ValleyRAT Backdoor Hides in QN Wallpaper: Detection & IOCs (TL-2026-2256) — High severity, 17 IOCs, 9 detection rules.)
- **ID:** TL-2026-2256
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Void Arachne (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 17 (3 shown free below)

## Description

Kaspersky telemetry has identified a wave of ValleyRAT (also tracked as Winos 4.0) distribution disguised as the legitimate Chinese desktop-customization adware application QN Wallpaper. Attackers repackaged the adware installer so that its signed executable, QnWallpaper.exe, is placed alongside a malicious libcef.dll in the same install directory (C:\Program Files\QNWallpaper\5.4.0.1662\); when the signed process starts it resolves and loads the attacker's DLL from that directory instead of (or in addition to) any legitimate Chromium Embedded Framework component, executing the backdoor's loader stage under the umbrella of a validly signed binary. The loader disables Windows Defender by setting the DisableAntiSpyware registry value, adds itself to system autorun so it survives reboot, and attempts privilege escalation via the `runas` verb when the current user is not an administrator. The delivery site (qnwallpaper[.]keansoft[.]cn) fronts the trojanized adware download, while a Tencent Meeting URL (meeting[.]tencent[.]com) is used as a decoy landing page during the infection flow.

Once installed, ValleyRAT/Winos 4.0 behaves as a full-featured, plugin-based backdoor: it harvests keystrokes and clipboard contents, captures screenshots, can reboot or shut down the host, and downloads/loads additional malicious modules on operator command. To resist takedown it flags its own process as critical to the OS, so any attempt to forcibly terminate it triggers a Windows blue-screen-of-death rather than allowing the process to be killed cleanly. Kaspersky recorded more than 100,000 detections of ValleyRAT and associated malware affecting over 1,500 unique users during 2026, concentrated in China and India, consistent with an opportunistic, adware-bundled distribution model rather than narrowly targeted spear-phishing.

ValleyRAT/Winos 4.0 is the signature backdoor of the Chinese-speaking cybercrime/espionage cluster tracked as Silver Fox (aka SwimSnake, The Great Thief of Valley, UTG-Q-1000, Void Arachne), an evolution of legacy Gh0st RAT-derived tooling built around a modular plugin architecture. A leaked builder (compiled March 2025) exposed the backdoor's internals: 19 paired 32/64-bit main plugins covering beaconing, keylogging, audio/video/screen capture, remote terminal, file/registry management, scheduled-task persistence, proxy tunneling, a DDoS stress-test module, and credential theft from Chinese applications (QQ, WeChat, Telegram) and browsers. A separate Driver Plugin embeds a 64-bit kernel-mode rootkit derived from the public 'Hidden' rootkit project that hides registry keys/files, protects the malware's process, injects shellcode via APC queuing, and force-deletes 50+ competing EDR/AV drivers (including Kaspersky, Qihoo 360, Huorong, and Tencent security products) at startup. Related Silver Fox campaigns documented in the same period show the group's rapid tooling evolution: abuse of a Microsoft-signed WatchDog Antimalware driver (amsdk.sys) to kill PP/PPL-protected security processes (BYOVD), a three-driver BYOVD chain (adding BootRepair.sys and EnPortv.sys) against a Japanese industrial manufacturer via trusted-software hijacking (ConvertToPDF.exe/PDFDirect.exe sideloading), and tax-themed phishing lures against Indian and Russian organizations that deliver a new ValleyRAT plugin loading a previously undocumented Python-based backdoor, ABCDoor. This QN Wallpaper campaign reuses the DLL-sideload technique previously seen in a 2025 PNGPlug loader campaign that also abused libcef.dll, suggesting shared tooling/infrastructure across the actor's distribution chains.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1204 User Execution
- T1129 Shared Modules
- T1547 Boot or Logon Autostart Execution
- T1548 Abuse Elevation Control Mechanism
- T1574 Hijack Execution Flow
- T1685 Disable or Modify Tools
- T1112 Modify Registry
- T1055 Process Injection
- T1057 Process Discovery
- T1082 System Information Discovery
- T1056 Input Capture
- T1113 Screen Capture
- T1123 Audio Capture
- T1555 Credentials from Password Stores
- T1571 Non-Standard Port
- T1573 Encrypted Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Trojanized QnWallpaper.exe Sideloading Malicious libcef.dll** (`TL-2026-2256-SPL-001`)

Detects the signed QnWallpaper.exe (v5.4.0.1662) installer/executable being launched from the QNWallpaper install directory and subsequently loading a libcef.dll image that is not part of a legitimate Chromium Embedded Framework install — the DLL sideload technique used to smuggle the ValleyRAT (Winos 4.0) loader stage under a validly signed binary. Also matches on known trojanized installer/DLL hashes.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195, T1204, T1129, T1574
- **Data sources:** sysmon, windows_security, microsoft_defender_for_endpoint
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=7)
| eval event_type=if(EventCode=1, "process_create", "image_load")
| where (event_type="process_create" AND match(lower(Image), "qnwallpaper\.exe$") AND match(lower(Image), "qnwallpaper\\\\5\.4\.0\.1662"))
   OR (event_type="image_load" AND match(lower(Image), "qnwallpaper\.exe$") AND match(lower(ImageLoaded), "libcef\.dll$") AND NOT match(lower(ImageLoaded), "chrome|cef\\\\\d|program files\\\\google"))
   OR (Hash="MD5=c24e99f9437feacaa63766a3cde3fe3d" OR Hash="MD5=07ddbbe2c71c45577a7a4fbcdba0df91" OR Hash="MD5=8a626d844943da3456b044f38deae3a2")
| stats earliest(_time) as first_seen, latest(_time) as last_seen, count by Computer, User, Image, ImageLoaded, Hashes, event_type
| where count > 0
```

### Microsoft KQL

```kql
let TrojanHashes = dynamic(["c24e99f9437feacaa63766a3cde3fe3d","07ddbbe2c71c45577a7a4fbcdba0df91","8a626d844943da3456b044f38deae3a2"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FolderPath has_cs @"QNWallpaper\5.4.0.1662" and FileName =~ "QnWallpaper.exe"
| project Timestamp, DeviceName, AccountName, FolderPath, FileName, MD5, InitiatingProcessFileName
| union (
    DeviceImageLoadEvents
    | where Timestamp > ago(24h)
    | where InitiatingProcessFileName =~ "QnWallpaper.exe" and FileName =~ "libcef.dll"
    | where not(FolderPath has "Chrome") and not(FolderPath has "CEF")
    | project Timestamp, DeviceName, AccountName, FolderPath, FileName, MD5, InitiatingProcessFileName
)
| union (
    DeviceFileEvents
    | where Timestamp > ago(24h)
    | where MD5 in (TrojanHashes)
    | project Timestamp, DeviceName, AccountName, FolderPath, FileName, MD5, InitiatingProcessFileName
)
```

### Sigma

```yaml
title: Trojanized QnWallpaper.exe Sideloading Malicious libcef.dll (ValleyRAT/Winos 4.0)
id: 7c1e4a2e-3b5d-4f6a-9c8e-2a1d5f7b9c3e
status: experimental
description: Detects the signed QnWallpaper.exe installer loading a non-legitimate libcef.dll from the QNWallpaper 5.4.0.1662 install directory, the DLL sideload technique used to launch the ValleyRAT (Winos 4.0) loader stage.
references:
    - https://thehackernews.com/2026/08/valleyrat-backdoor-hides-in-signed.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-31
tags:
    - attack.initial-access
    - attack.t1195
    - attack.execution
    - attack.t1204
    - attack.t1129
    - attack.defense-evasion
    - attack.t1574.002
    - attack.tool.valleyrat
    - attack.tool.winos
detection:
    selection_process:
        Image|endswith: '\QnWallpaper.exe'
        Image|contains: 'QNWallpaper\5.4.0.1662'
    selection_sideload:
        Image|endswith: '\QnWallpaper.exe'
        ImageLoaded|endswith: '\libcef.dll'
    filter_legit_cef:
        ImageLoaded|contains:
            - '\Google\Chrome\'
            - '\CEF\'
    selection_hash:
        Hashes|contains:
            - 'c24e99f9437feacaa63766a3cde3fe3d'
            - '07ddbbe2c71c45577a7a4fbcdba0df91'
            - '8a626d844943da3456b044f38deae3a2'
    condition: selection_process or (selection_sideload and not filter_legit_cef) or selection_hash
falsepositives:
    - A legitimate, unmodified QN Wallpaper install where libcef.dll ships as a genuine bundled CEF component (rare outside this trojanized redistribution)
level: high
logsource:
    category: image_load
    product: windows
```

**Known false positives:**

- An untampered, legitimately signed QN Wallpaper installation where libcef.dll is a genuine CEF component shipped by the vendor — rare given this is a trojanized redistribution channel, but verify signature chain and file hash before escalating

**Tuning notes:** If QN Wallpaper is not an approved application in the environment, convert this to a blanket block/alert on any execution of QnWallpaper.exe. Extend the trojan-hash allowlist as new campaign samples are published, and add a dedicated rule for the 2025 PNGPlug libcef.dll sideload variant referenced in research to catch shared-infrastructure reuse.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Trojanized [indicator] Sideloading Malicious [indicator] (locked: unlock with TL Creds)
- ValleyRAT Post-Exploitation: Defender Tamper, Autorun Persistence, and Kernel Rootkit Registry Keys (locked: unlock with TL Creds)
- ValleyRAT C2 Beaconing to Non-Standard-Port Encrypted Channels (locked: unlock with TL Creds)
- Trojanized [indicator] Sideloading Malicious [indicator] (locked: unlock with TL Creds)
- ValleyRAT Post-Exploitation: Defender Tamper, Autorun Persistence, and Kernel Rootkit Registry Keys (locked: unlock with TL Creds)
- ValleyRAT C2 Beaconing to Non-Standard-Port Encrypted Channels (locked: unlock with TL Creds)
- ValleyRAT Post-Exploitation: Defender Tamper, Autorun Persistence, and Kernel Rootkit Registry Keys (locked: unlock with TL Creds)
- ValleyRAT C2 Beaconing to Non-Standard-Port Encrypted Channels (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 17)

Defanged, TLP:CLEAR.

- IP address: `103.45.66[.]18`
- Domain: `qnwallpaper[.]keansoft[.]cn`
- File hash: `c24e99f9437feacaa63766a3cde3fe3d`

Full set of 17 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [ValleyRAT Backdoor Hides in Signed 'QN Wallpaper' Installer via DLL Sideloading](https://thehackernews.com/2026/08/valleyrat-backdoor-hides-in-signed.html)
- [Silver Fox Deploys ABCDoor Malware via Tax-Themed Phishing in India and Russia](https://thehackernews.com/2026/05/silver-fox-deploys-abcdoor-malware-via.html)
- [SilverFox Targets Japanese Manufacturer with 3-Driver BYOVD Chain and ValleyRAT](https://thehackernews.com/2026/07/silverfox-targets-japanese-manufacturer.html)
- [Silver Fox Exploits Microsoft-Signed WatchDog Driver to Deploy ValleyRAT Malware](https://thehackernews.com/2025/09/silver-fox-exploits-microsoft-signed.html)
- [Silver Fox Targets Indian Users With Tax-Themed Emails Delivering ValleyRAT Malware](https://thehackernews.com/2025/12/silver-fox-targets-indian-users-with.html)
- [SilverFox Evolves: Trusted Software Hijacking Delivers ValleyRAT in Japan](https://www.catonetworks.com/blog/cato-ctrl-silverfox-evolves/)
- [Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits](https://research.checkpoint.com/2025/cracking-valleyrat-from-builder-secrets-to-kernel-rootkits/)
- [Chasing the Silver Fox: Cat & Mouse in Kernel Shadows](https://research.checkpoint.com/2025/silver-fox-apt-vulnerable-drivers/)
- [Analyzing the Silver Fox tax campaign and the new ABCDoor backdoor](https://securelist.com/silver-fox-tax-notification-campaign/119575/)
- [Silver Fox Expands Winos 4.0 (ValleyRAT) and HoldingHands RAT Cyber Attacks to Japan and Malaysia](https://www.rescana.com/post/silver-fox-expands-winos-4-0-valleyrat-and-holdinghands-rat-cyber-attacks-to-japan-and-malaysia)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2256