Cybersecurity researchers at Kaspersky have uncovered a new malware campaign utilizing a modified version of a legitimate Chinese desktop wallpaper application, QN Wallpaper, to deliver the ValleyRAT backdoor. The campaign, which has been detected over 100,000 times in 2026, leverages DLL sideloading to evade detection and establish persistent control over infected systems.
The malicious installer disguises itself as software associated with popular applications like DingTalk, Google Chrome, or Tencent Meeting, depending on the filename. While appearing to install a familiar application, it quietly deploys the modified QN Wallpaper in the background. This tactic makes the initial infection appear as a normal software installation, removing a common indicator of malware.
Kaspersky's investigation began when a customer submitted a sample for classification as adware. Initial analysis suggested it was legitimate adware, but suspicious network activity prompted a deeper examination. Researchers discovered that the advertising component of the modified QN Wallpaper did not perform its intended function of displaying ads or delivering partner apps. Instead, it initiated an infection chain leading to the deployment of ValleyRAT.
The core of the attack relies on DLL sideloading, a technique where a malicious DLL is placed in a location where a legitimate program expects to find a trusted library. In this case, the modified QN Wallpaper and its companion process load a malicious version of `libcef.dll` upon startup, allowing the attacker's code to execute under the guise of a signed, legitimate application.
Beyond delivering the backdoor, the installer also establishes persistence and attempts to disable Windows Defender by modifying the `DisableAntiSpyware` registry key. Once the malicious library runs, it checks for administrator privileges and, if necessary, attempts to relaunch with elevated permissions to continue the infection process.
The ValleyRAT payload itself is encrypted and can be sourced from either a separate PeLoader file or embedded resources within `libcef.dll`, depending on the legitimate process that loads the malicious library. These payloads use AES encryption, and their configurations primarily differ in the command-and-control (C2) addresses they utilize, providing operators with multiple ways to manage compromised systems.
Once active, ValleyRAT functions as a comprehensive backdoor, connecting to its C2 infrastructure and enabling a wide range of malicious activities. It can collect keystrokes and clipboard contents, monitor the active window, and gather extensive system information, including hostname, IP addresses, Windows version, CPU details, disk space, graphics adapter, and language settings. The malware saves all collected data to a file on the disk.
Attackers can also command ValleyRAT to take screenshots, reboot or shut down the infected machine, wipe logs, modify its C2 addresses, and download additional modules. This modularity allows the attackers to expand the malware's capabilities post-infection without needing to include every function in the initial payload.
ValleyRAT incorporates several anti-removal mechanisms. Depending on its configuration, it can inject code into `svchost.exe` to ensure the backdoor restarts if its process is terminated. It can also mark its own process as "critical," meaning that attempting to terminate it could trigger a system crash, effectively deterring defenders from easily removing it. The malware is also capable of detecting security and traffic-analysis tools.
