ValleyRAT masquerading as adware
ValleyRAT backdoor distributed as adware via malicious installer.
Threat actors are distributing the ValleyRAT backdoor disguised as adware, using a malicious installer that masquerades as legitimate software. The installer deploys a modified adware tool, QN Wallpaper, which is then used for DLL sideloading to execute the backdoor. The infection chain also includes disabling Windows Defender and potentially other diversionary tactics.
AI summary of the linked source. Not reviewed by an editor. How this works
Run QN Wallpaper?
Get an email when a new story names QN Wallpaper, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThreat actors are exploiting users' trust in seemingly legitimate software by bundling the ValleyRAT backdoor inside a malicious installer disguised as adware. The attack leverages DLL sideloading through a modified version of QN Wallpaper, a technique that abuses trusted application processes to execute malicious code under the radar. Critically, the malware also disables Windows Defender, stripping away a key layer of host-based protection. This campaign highlights how social engineering combined with living-off-the-land techniques can bypass traditional defenses when users download software from unverified sources. Organizations without strict software installation policies and endpoint controls are particularly exposed.
What helps against this
How we list vendors- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- url — hxxps://qnwallpaper[.]keansoft[.]cn/
- hash_md5 — c24e99f9437feacaa63766a3cde3fe3d
- hash_md5 — 7ad1e3ef4e6d9d636c9e7e967733850e
- hash_md5 — 96b4c1d0683dce22bd3223e1e40689c1
- hash_md5 — 9b86d3ab6cef15c633933fbbeab39c0a
- hash_md5 — edfdc30cbd85879776b8f735ea7de1f1
- hash_md5 — 07ddbbe2c71c45577a7a4fbcdba0df91
- hash_md5 — 48826d5ca845979d2e6ebd66dc1aae90
- hash_md5 — 6c158c0f8e029342192d4f0d72e102b7
- hash_md5 — 9a71d6a41cd258b9e89cdc5fc224de73
- url — hxxps://meeting[.]tencent[.]com/download/