Indicators of compromise · ValleyRAT — 4 shown
103[.]82[.]53[.]214:7661hxxp://ruimukj[.]top/getinstall64202[.]61[.]157[.]33:2135714[.]128[.]53[.]155:21131
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
Silver Fox Distributes ValleyRAT Inside Signed Chinese Adware
Summary
Kaspersky documented the Silver Fox group distributing the ValleyRAT backdoor disguised as QN Wallpaper, a genuine signed Chinese desktop-wallpaper adware tool, in August 2026.
Details
The disguise relies on DLL sideloading: the installer unpacks a modified copy of QN Wallpaper and runs its signed QnWallpaper.exe, which loads a malicious libcef.dll planted in the same directory — executing the backdoor inside a legitimately signed process. Before the adware runs, the installer disables Windows Defender via the DisableAntiSpyware registry key and registers the program in autorun; without administrator rights it relaunches itself with runas. ValleyRAT (tracked as Winos 4.0) collects keystrokes, clipboard contents and screenshots, delivers further modules, and can flag its own process as critical so terminating it triggers a blue screen.
Assessment
This is a clear example of adware and affiliate networks being weaponised beyond their apparent nuisance value. Across 2026 Kaspersky recorded more than 100,000 ValleyRAT detections affecting over 1,500 unique users, mostly in China and India. Users should avoid software of questionable reputation and, critically, never add such software to security-solution exclusion lists.