ValleyRAT masquerading as adware

Summary

Threat actors are distributing the ValleyRAT backdoor disguised as adware, using a malicious installer that masquerades as legitimate software. The installer deploys a modified adware tool, QN Wallpaper, which is then used for DLL sideloading to execute the backdoor. The infection chain also includes disabling Windows Defender and potentially other diversionary tactics.

Full text

Table of Contents Malicious installerDLL Sideloading via libcef.dllRunning the malicious codeValleyRATTargets and attributionConclusionIoCMD5Network Authors Pavel Bukhtenko Attackers typically try to pass off malware as legitimate applications or as potentially unwanted programs that users deliberately search for and download, such as cheats or cracks. They often rely on ad and affiliate networks to deliver their creations to victims’ devices. This post examines a less conventional case: a well-known backdoor distributed under the guise of adware. The attackers may have chosen this distribution method because the adware was signed by the developer. On top of that, users often manually add these apps to exclusions, so their useful features don’t get blocked. Some time ago, a client asked us to analyze a file with the MD5 hash c24e99f9437feacaa63766a3cde3fe3d and add it to our detection database. We initially classified it as adware, but a cursory analysis turned up suspicious network activity, which prompted us to dig deeper. It turned out the sample did far more than serve ads. In fact, its advertising functionality doesn’t even work; instead, it triggers an infection chain that delivers the ValleyRAT backdoor. Malicious installer The file the client shared with us turned out to be an installer that performed different actions depending on the two-letter suffix used in the file name, positioned just before the numeric string. Installer name What it does FS_SETUP_DD_173.exe Installs DingTalk, a workplace collaboration platform FS_SETUP_GG_173.exe Installs Google Chrome FS_SETUP_HY_173.exe Opens hxxps://meeting[.]tencent[.]com/download/ These actions are most likely designed to divert the user’s attention away from the sample’s malicious functionality. Regardless of the file name, the installer deploys a modified Chinese desktop wallpaper management tool called QN Wallpaper (hxxps://qnwallpaper[.]keansoft[.]cn/) and adds it to the registry’s autorun entries. The original version of QN Wallpaper is genuine adware: on installation, it delivers bundled partner apps to the device and then displays ad banners to the user. In this case, however, the attackers use it to carry out DLL sideloading, a technique that allows malicious code to run under the guise of a signed process by way of a malicious DLL. The QN Wallpaper modules, along with the malicious components, are unpacked to C:\Program Files\QNWallpaper\5.4.0.1662\<random string of letters and digits>. The following files are saved in that directory: File name MD5 Purpose 1.zip 7ad1e3ef4e6d9d636c9e7e967733850e Archive containing the adware files QnWallpeper.exe and QnwPlayer.exe, along with the modules needed to run them 7z.dll 96b4c1d0683dce22bd3223e1e40689c1 7z archiver library 7z.exe 9b86d3ab6cef15c633933fbbeab39c0a Archiver chrome_elf.dll edfdc30cbd85879776b8f735ea7de1f1 Library used to launch Electron-based applications libcef.dll 07ddbbe2c71c45577a7a4fbcdba0df91 Malicious library PeLoader 48826d5ca845979d2e6ebd66dc1aae90 File containing the encrypted backdoor QnWallpaper.exe 6c158c0f8e029342192d4f0d72e102b7 Adware module QnwPlayer.exe 9a71d6a41cd258b9e89cdc5fc224de73 Adware module <random string of letters and digits>Nedca.exe c24e99f9437feacaa63766a3cde3fe3d Malicious installer copy After unpacking, the installer uses the DisableAntiSpyware registry key to disable Windows Defender and then launches QnWallpaper.exe. Disabling Windows Defender DLL Sideloading via libcef.dll QnWallpaper.exe has dependencies in libcef.dll, so this library gets loaded when the process starts. QnWallpaper.exe also launches QnwPlayer.exe, which likewise calls libcef.dll. QnWallpaper and QnwPlayer won’t actually function correctly, because the functions exported from libcef.dll are put into an infinite sleep. However, in case that sleep is ever interrupted, the attackers have implemented a function that loads all the necessary functions from the original library into memory, provided it can locate that library on the system. Example of an exported function Loading functions from the original libcef.dll The malicious functionality in libcef.dll is invoked by a call to DllMain, which runs automatically when the library is loaded. That said, alongside the original exports, the library also contains a function named RunDLL, which likewise initiates execution of the malicious code. QnWallpaper never calls this function. We suspect the attackers intended to invoke it manually via rundll32 or planned to use a separate executable for this purpose, one that wasn’t included in the package downloaded by the sample. The RunDLL function Running the malicious code When the library is loaded, code runs that ensures QnWallpaper.exe persists at startup: it adds a file extension association and drops a file with the corresponding extension in C:\Documents and Settings\<username>\Start Menu\Programs\Startup\. This is followed by a chain of wrapper functions whose main job is to call the next one. Execution eventually reaches the function that contains the actual malicious code. For convenience, we’ll refer to it as mw_entry. Inside mw_entry, the malware checks two things: Whether the current user belongs to the Administrators group Which process the DLL is running inside Checking for administrator privileges If the user isn’t a member of the Administrators group, the program attempts to obtain administrator privileges by using the runas utility. Relaunching the process to obtain administrator privileges Once it has administrator privileges, the malicious code determines which process the DLL has been loaded into, and selects the payload accordingly: If the library is running inside QnWallpaper.exe, the payload is loaded from the PeLoader file. Encrypted payload If the library is running inside QnwPlayer.exe, the payload is loaded from libcef.dll resources. Retrieving the payload from a resource Both payloads are AES-encrypted DLLs that contain the ValleyRAT backdoor. The only difference between them is their configuration, specifically, the C2 server addresses. After decryption, libcef.dll checks the magic signatures in the resulting PE file’s headers to confirm the sample is valid. If this check fails, the library releases its resources and takes no further action. Validating the PE file headers after decryption If the headers check out, libcef.dll loads the payload into the process’s memory space and hands control over to the backdoor by calling DllMain. Calling DllMain ValleyRAT ValleyRAT begins its operation by parsing its configuration, which consists of key:value pairs concatenated into a single string. To obfuscate this configuration, the attackers wrote the string in reverse. Obfuscated configuration During parsing, the backdoor restores the correct character order and reads the key values one by one. The set of keys is the same regardless of which process the backdoor is running in. Parsing the configuration Some of the configuration fields are listed below: Key Description p? C2 server IP address o? C2 server port t? Protocol (1: TCP, 0: UDP) dd Sleep duration before executing the main code cl Sleep duration after receiving the corresponding command from the server bz Configuration creation date bh Whether to mark the current process as critical (so that terminating it triggers a blue screen of death) Possible values: 1: yes, 0: no ll Whether to check for running security/traffic-analysis tools/processes (1: check, 0: do not check) sh Whether to inject code into svchost that will restart the malicious process (1: inject, 0: do not inject) The backdoor uses several techniques to protect its process. Some are configuration-dependent, while others are always applied: Injecting code into svchost to restart the process: a configurable option. The backdoor allocates memory inside the svchost process, injects code into it, and sets PAGE_NOACCESS permissions on the memory page containing the injected data. It then creates a suspended t

Indicators of Compromise

• url — hxxps://qnwallpaper[.]keansoft[.]cn/
• hash_md5 — c24e99f9437feacaa63766a3cde3fe3d
• hash_md5 — 7ad1e3ef4e6d9d636c9e7e967733850e
• hash_md5 — 96b4c1d0683dce22bd3223e1e40689c1
• hash_md5 — 9b86d3ab6cef15c633933fbbeab39c0a
• hash_md5 — edfdc30cbd85879776b8f735ea7de1f1
• hash_md5 — 07ddbbe2c71c45577a7a4fbcdba0df91
• hash_md5 — 48826d5ca845979d2e6ebd66dc1aae90
• hash_md5 — 6c158c0f8e029342192d4f0d72e102b7
• hash_md5 — 9a71d6a41cd258b9e89cdc5fc224de73
• url — hxxps://meeting[.]tencent[.]com/download/

Entities