Silver Fox uses adware to distribute ValleyRAT backdoor

As reported by The Hacker News, the threat actor known as Silver Fox is distributing the ValleyRAT backdoor disguised as a signed Chinese adware application. This method allows the malware to run under a trusted process, affecting users who might add such software to antivirus exclusions, according to Kaspersky.

The attackers have bundled ValleyRAT, also tracked as Winos 4.0, with QN Wallpaper, a legitimate Chinese desktop-wallpaper tool. Once installed, ValleyRAT grants the operator full control over the compromised machine, capable of collecting sensitive data, capturing screenshots, and deploying additional malicious modules. The attack leverages DLL sideloading, where a modified copy of QN Wallpaper is unpacked and its signed executable loads a malicious DLL planted in the same directory. This allows the backdoor to execute within a trusted process, evading signature-based security controls.

Before the adware component activates, the installer disables Windows Defender and adds the program to autorun entries. If the logged-in user lacks administrator rights, the malware uses "runas" to acquire them. ValleyRAT also flags its process as critical, triggering a blue screen of death if termination is attempted. Kaspersky's analysis points to Silver Fox, a group previously observed using similar DLL sideloading techniques, as the likely perpetrator.

Source: The Hacker News