Security researchers at Kaspersky have uncovered a sophisticated attack chain where the Silver Fox threat group hides the ValleyRAT backdoor inside a signed copy of QN Wallpaper, a real Chinese desktop-wallpaper application. Because the app is digitally signed by a legitimate publisher, users who run it and add it to their antivirus exclusion list unwittingly grant the hidden malware a free pass to operate without security-tool interference.
The trick relies on DLL sideloading: the installer drops a malicious libcef.dll next to the genuine QnWallpaper.exe, and when Windows loads the app, it silently picks up the rogue library. Before launching, the installer also disables Windows Defender via the DisableAntiSpyware registry key and adds itself to autorun. Once active, ValleyRAT — also tracked as Winos 4.0 — gives its operator full control: keylogging, clipboard capture, screenshots, and the ability to push additional malware modules. If someone tries to kill the process, the malware can trigger a blue screen of death by flagging itself as a critical system process.
How to check if you’re affected
Affected versions of this campaign target any Windows system running QN Wallpaper or similarly questionable adware that was added to antivirus exclusions. Open your antivirus or Windows Security settings and review the list of excluded programs and folders. Remove any exclusion for software you didn’t intentionally whitelist or that you don’t fully trust. Check your installed apps for QN Wallpaper or any unrecognised Chinese desktop-customisation tool and uninstall it. Kaspersky published indicators of compromise including the MD5 hash c24e99f9437feacaa63766a3cde3fe3d for the malicious installer — if you have it on disk, treat the machine as compromised.