ValleyRAT masquerading as adware

This analysis details a campaign that distributes the ValleyRAT backdoor hidden inside a modified QN Wallpaper adware installer which disables Defender, uses DLL sideloading and privilege escalation to load an AES-encrypted backdoor, and provides keylogging, clipboard capture, screenshotting and module-loading capabilities; the report includes IOCs (file hashes and C2 IPs/ports), notes over 100,000 detections and ~1,500 unique users affected (primarily China and India), and attributes activity to the Silver Fox operator.