Overview
- Kaspersky analyzed a malicious installer that unpacks a modified, legitimately signed QN Wallpaper executable and places a malicious libcef.dll alongside it so the trusted process loads ValleyRAT via DLL sideloading.
- The installer and payload use multiple evasion and persistence tricks, including setting the DisableAntiSpyware registry value to disable Windows Defender, adding autorun entries, relaunching with runas for elevation, and marking processes as critical to resist termination.
- Kaspersky links the sample to the Silver Fox threat actor based on payload features and prior tool reuse, noting the same libcef.dll filename appeared in earlier ValleyRAT activity documented by other researchers.
- The vendor published indicators of compromise, including MD5 hashes, C2 IP addresses and domains, and host artifacts, but emphasized the QN Wallpaper delivery route is documented from a single submitted installer and its wider scale remains unconfirmed.
- Organizations and users should avoid installing questionable third-party apps on work devices, never add such programs to antivirus exclusion lists, enforce third-party software policies, and apply Kaspersky's IoCs to hunt and remediate potential infections.