Indicators of compromise · ValleyRAT — 4 shown
205[.]186[.]112[.]235:443hxxp://ruihankj[.]top/getinstall64hxxp://fafdafaf[.]shop/getinstall64hxxp://fdsfsffdsf[.]shop/getinstall64
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
Silver Fox
Silver Fox is a China-linked cybercrime group attributed by QiAnXin Threat Intelligence as the operator of the Modbeacon Rat, a Rust-based remote access trojan (RAT). The group targets technology firms, educational institutions, and state-owned enterprises across Asia.
Modus Operandi
- Distributes malware via counterfeit software installers using SEO poisoning
- Targets primarily across Asian markets
- Uses Modbeacon Rat with gRPC streaming for encrypted C2 communication
- Infrastructure hosted on Amazon and Cloudflare CDN (raw/digests/Cyber-Digest-2026-07-11.md)
ValleyRAT Inside Signed Adware (Sep 2026)
Kaspersky documented Silver Fox distributing the ValleyRAT backdoor disguised as QN Wallpaper, a genuine, signed Chinese desktop-wallpaper adware tool, using DLL sideloading: the installer runs the legitimate QnWallpaper.exe, which loads a malicious libcef.dll, so the backdoor executes inside a genuinely signed process. Before the adware runs, the installer disables Windows Defender via the DisableAntiSpyware registry key and registers the program in autorun — letting the attacker embed malware in a signed adware chain rather than a forged installer. (Kaspersky, 2026-08-31)(raw/digests/Cyber-Digest-2026-09-01.md)
Associated Malware
- Modbeacon Rat — Rust-based RAT with gRPC streaming C2
Related Pages
- Uat 7810 — Another China-linked APT
- Modbeacon Rat — Primary tool used by this group