ValleyRAT Backdoor Disguised as QN Wallpaper Adware: Void Arachne DLL Sideloading Campaign — OTX Detection Pack

---
title: DLL Sideloading via Signed Process - ValleyRAT / QN Wallpaper Masquerade
id: 9f2a4c11-7b3e-4d8a-a1c5-3e6f9b2d1a07
status: experimental
description: Detects a signed executable loading an unsigned DLL from its own directory, consistent with Void Arachne ValleyRAT sideloading via trojanized QN Wallpaper installer
references:
  - https://securelist.com/valleyrat-backdoor-adware/121175/
author: Security Arsenal Threat Intelligence
date: 2026/08/31
logsource:
  category: image_load
  product: windows
detection:
  selection_signed_parent:
    Signed: 'true'
  selection_unsigned_dll:
    ImageLoaded|endswith: '.dll'
    SignatureStatus|contains:
      - 'unsigned'
      - 'invalid'
  filter_system_paths:
    ImageLoaded|startswith:
      - 'C:\Windows\'
      - 'C:\Program Files\Common Files\'
  condition: selection_signed_parent and selection_unsigned_dll and not filter_system_paths
falsepositives:
  - Legitimate software shipping unsigned plugins
  - Developer machines with custom DLL builds
level: high
tags:
  - attack.defense_evasion
  - attack.t1574.002
---
title: ValleyRAT C2 Network Connection - Void Arachne
id: 2c8e1b44-9a5f-4c2d-b3e7-8d1f6a4c9e02
status: experimental
description: Detects outbound connections to known ValleyRAT command-and-control infrastructure attributed to Void Arachne
references:
  - https://securelist.com/valleyrat-backdoor-adware/121175/
author: Security Arsenal Threat Intelligence
date: 2026/08/31
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationIp:
      - '103.45.66.18'
      - '192.253.225.173'
  condition: selection
falsepositives:
  - Unlikely; these IPs are confirmed C2
level: critical
tags:
  - attack.command_and_control
  - attack.t1071
---
title: ValleyRAT Known Sample Hash Execution
id: 5d7f3a92-1c8b-4e6d-92a4-6b3c8f1e5d09
status: experimental
description: Detects execution of known ValleyRAT trojanized QN Wallpaper installer samples by MD5 hash
references:
  - https://securelist.com/valleyrat-backdoor-adware/121175/
author: Security Arsenal Threat Intelligence
date: 2026/08/31
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Hashes|contains:
      - 'c24e99f9437feacaa63766a3cde3fe3d'
      - '07ddbbe2c71c45577a7a4fbcdba0df91'
      - '8a626d844943da3456b044f38deae3a2'
  condition: selection
falsepositives:
  - None expected
level: critical
tags:
  - attack.execution
  - attack.t1204.002

// ValleyRAT / Void Arachne hunt: C2 connections + suspicious DLL loads from user-writable paths
// Microsoft Sentinel / Microsoft 365 Defender
let C2IPs = dynamic(["103.45.66.18", "192.253.225.173"]);
let KnownHashes = dynamic(["c24e99f9437feacaa63766a3cde3fe3d", "07ddbbe2c71c45577a7a4fbcdba0df91", "8a626d844943da3456b044f38deae3a2"]);
union isfuzzy=true
    (
    DeviceNetworkEvents
    | where TimeGenerated > ago(90d)
    | where RemoteIP in (C2IPs)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, RemoteIP, RemotePort, ActionType, HuntStage="C2 Connection"
    ),
    (
    DeviceImageLoadEvents
    | where TimeGenerated > ago(90d)
    | where MD5 in (KnownHashes) or SHA1 in (KnownHashes) or SHA256 in (KnownHashes)
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, FolderPath, MD5, HuntStage="Known Hash Load"
    ),
    (
    DeviceImageLoadEvents
    | where TimeGenerated > ago(30d)
    // Sideloading heuristic: DLL loaded from AppData/Temp/Public alongside wallpaper-themed installers
    | where FolderPath has_any ("\\AppData\\", "\\Temp\\", "\\Public\\", "\\Downloads\\")
    | where FileName endswith ".dll"
    | where InitiatingProcessFileName has_any ("wallpaper", "qn", "wp", "desk") or InitiatingProcessFolderPath has "wallpaper"
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, FileName, FolderPath, MD5, HuntStage="Sideload Heuristic"
    ),
    (
    DeviceProcessEvents
    | where TimeGenerated > ago(30d)
    | where FileName has_any ("wallpaper", "qnwallpaper") or ProcessCommandLine has_any ("wallpaper", "qn ")
    | project TimeGenerated, DeviceName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, MD5, HuntStage="Installer Execution"
    )
| order by TimeGenerated desc

# ValleyRAT / Void Arachne endpoint IOC hunt script
# Run elevated on suspected hosts. Checks C2 connections, known hashes, sideload artifacts, and persistence.

$c2Ips = @("103.45.66.18", "192.253.225.173")
$knownMd5 = @("c24e99f9437feacaa63766a3cde3fe3d", "07ddbbe2c71c45577a7a4fbcdba0df91", "8a626d844943da3456b044f38deae3a2")
$findings = @()

Write-Host "[1/5] Checking active and recent TCP connections to ValleyRAT C2..." -ForegroundColor Cyan
$conns = Get-NetTCPConnection -ErrorAction SilentlyContinue | Where-Object { $c2Ips -contains $_.RemoteAddress }
foreach ($c in $conns) {
    $proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
    $findings += "[C2 CONNECTION] $($c.RemoteAddress):$($c.RemotePort) <- PID $($c.OwningProcess) ($($proc.ProcessName)) [$($c.State)]"
}

Write-Host "[2/5] Checking DNS cache and netstat history artifacts..." -ForegroundColor Cyan
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object { $c2Ips -contains $_.Data }
foreach ($d in $dnsCache) { $findings += "[DNS CACHE] $($d.Entry) -> $($d.Data)" }

Write-Host "[3/5] Scanning user-writable paths for known ValleyRAT hashes..." -ForegroundColor Cyan
$scanPaths = @("$env:APPDATA", "$env:LOCALAPPDATA", "$env:TEMP", "C:\Users\Public", "C:\ProgramData")
foreach ($path in $scanPaths) {
    if (Test-Path $path) {
        Get-ChildItem -Path $path -Recurse -Include *.dll,*.exe -ErrorAction SilentlyContinue | ForEach-Object {
            $h = (Get-FileHash -Algorithm MD5 -Path $_.FullName -ErrorAction SilentlyContinue).Hash
            if ($knownMd5 -contains $h.ToLower()) { $findings += "[HASH MATCH] $($_.FullName) MD5=$h" }
        }
    }
}

Write-Host "[4/5] Hunting wallpaper-themed executables with adjacent DLLs (sideload indicator)..." -ForegroundColor Cyan
Get-ChildItem -Path "C:\Users\","C:\Program Files","C:\Program Files (x86)","C:\ProgramData" -Recurse -Include *.exe -ErrorAction SilentlyContinue |
    Where-Object { $_.Name -match "wallpaper|^qn" } | ForEach-Object {
        $adjacent = Get-ChildItem -Path $_.DirectoryName -Filter *.dll -ErrorAction SilentlyContinue
        foreach ($dll in $adjacent) {
            $sig = Get-AuthenticodeSignature -FilePath $dll.FullName -ErrorAction SilentlyContinue
            if ($sig.Status -ne "Valid") { $findings += "[SIDELOAD SUSPECT] Signed EXE: $($_.FullName) | Unsigned DLL: $($dll.FullName)" }
        }
    }

Write-Host "[5/5] Checking Run keys and scheduled tasks for wallpaper-themed persistence..." -ForegroundColor Cyan
$runKeys = @("HKCU:\Software\Microsoft\Windows\CurrentVersion\Run", "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run")
foreach ($rk in $runKeys) {
    if (Test-Path $rk) {
        (Get-ItemProperty $rk).PSObject.Properties | Where-Object { $_.Value -match "wallpaper|qn" } |
            ForEach-Object { $findings += "[RUN KEY] $rk\$($_.Name) = $($_.Value)" }
    }
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object { $_.TaskName -match "wallpaper|qn" -or $_.Actions.Execute -match "wallpaper|qn" } |
    ForEach-Object { $findings += "[SCHEDULED TASK] $($_.TaskName) -> $($_.Actions.Execute) $($_.Actions.Arguments)" }

Write-Host "`n===== FINDINGS =====" -ForegroundColor Yellow
if ($findings.Count -eq 0) { Write-Host "No ValleyRAT indicators found on this host." -ForegroundColor Green }
else { $findings | ForEach-Object { Write-Host $_ -ForegroundColor Red }; $findings | Out-File "$env:TEMP\valleyrat_hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').txt" }