ValleyRAT Delivered via Legitimate Adware: Detecting DLL Sideloading and Silver Fox Intrusion Activity

A newly documented ValleyRAT campaign illustrates a shift defenders need to internalize: the Silver Fox threat cluster is no longer relying solely on cracked games, fake browser updates, and SEO-poisoned installers. It is now staging its payload behind software that presents as ordinary adware — applications that look annoying but benign — and using DLL sideloading against legitimate, signed executables to load the implant in memory while inheriting the trusted reputation of the host binary.

This is operationally significant for two reasons. First, sideloading defeats a large class of allowlist- and signature-based controls, because the process that executes is a legitimate, properly signed application. Second, the adware wrapper produces plausible noise — pop-ups, browser modification, telemetry to advertising domains — that camouflages the RAT's data theft and command-and-control underneath. Analysts triaging an "adware" alert may close the ticket while Silver Fox establishes persistence and begins hands-on-keyboard activity.

If your SOC has a habit of deprioritizing potentially unwanted program (PUP) detections, this campaign is the reason to stop. ValleyRAT is a fully featured remote access trojan: keylogging, screen capture, credential and browser data theft, arbitrary command execution, and plugin-based extensibility. Once Silver Fox has it on a system, they have the system.

Technical Analysis

Affected platforms

• Operating system: Windows endpoints (the DLL sideloading chain and ValleyRAT payload are Windows-native)
• Delivery vector: Installers masquerading as adware / bundled utility software, distributed via malicious download portals, SEO poisoning, and malvertising-style funnels historically favored by Silver Fox operators
• Primary targets: Historically Chinese-speaking users and organizations, but the tradecraft is portable — the same sideloading pattern works against any locale's legitimate software

No CVE is associated with this campaign — this is not a vulnerability exploitation story. It is a living-off-legitimate-software story, which makes it harder to patch away and more dependent on behavioral detection.

Attack chain (defender's view)

1. Delivery: The user downloads an installer presenting as a free utility or ad-supported application. The installer is functional — it may genuinely deliver the advertised adware behavior, which is the point.
2. Staging: The installer drops a legitimate, signed executable alongside a malicious DLL crafted to be loaded by that executable. The DLL is placed in the same directory so that Windows' DLL search order resolves the malicious copy first.
3. Sideloading (MITRE ATT&CK T1574.002): When the signed binary executes — at install time or via a persistence-triggered relaunch — it loads the malicious DLL. To the EDR, a trusted process just loaded a library. The malicious code now runs inside the address space and reputation context of the signed binary.
4. Defense evasion and payload: The DLL decrypts/reflectively loads the ValleyRAT implant, frequently applying anti-analysis checks (sandbox detection, security product enumeration) before fully detonating.
5. Persistence: Registry Run keys, scheduled tasks, or service installation ensure the signed-binary-plus-DLL pair relaunches across reboots.
6. C2 and execution: ValleyRAT beacons to Silver Fox infrastructure, enabling credential theft, screen capture, file exfiltration, and follow-on payload delivery.

Exploitation status

This campaign is confirmed active in the wild and attributed to the Silver Fox threat cluster, which has maintained sustained ValleyRAT operations through 2025 and into 2026. Because there is no CVE and no KEV entry, your remediation lever is detection and control, not patching.

Detection & Response

The durable detection opportunities here are not hash-based — Silver Fox rotates those constantly. Focus on the behavioral signature of sideloading: unsigned or unsigned-but-odd DLLs loaded from non-standard directories by signed executables, and the persistence + network activity that follows.

SIGMA Rules

---
title: Signed Executable Loading Unsigned DLL from Writable Directory
description: Detects potential DLL sideloading where a signed process loads an unsigned DLL from user-writable or non-standard directories, consistent with ValleyRAT delivery behind adware wrappers.
references:
  - https://securityaffairs.com/198191/security/valleyrat-when-legitimate-software-becomes-a-malware-delivery-tool.html
  - https://attack.mitre.org/techniques/T1574/002/
author: Security Arsenal
date: 2026/04/06
id: 3c7a2f51-8b4d-4e9a-b1c6-7d2e5f9a0c31
status: experimental
tags:
  - attack.defense_evasion
  - attack.persistence
  - attack.t1574.002
logsource:
  category: image_load
  product: windows
detection:
  selection_paths:
    ImageLoaded|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
      - '\ProgramData\'
      - '\Downloads\'
  filter_signed:
    Signed: 'true'
    SignatureStatus: 'valid'
  condition: selection_paths and not filter_signed
falsepositives:
  - Legitimate applications that ship plugins in ProgramData or AppData (common with Electron apps and some updaters)
  - Baseline per-application and tune; alert on first-seen Image+ImageLoaded pairs
level: high
---
title: Adware-Style Installer Spawning Persistence Mechanisms
id: 9f1e4b27-6c3a-4d58-a2e9-5b8c1d7f0e42
status: experimental
description: Detects installer or utility-style processes creating persistence via Run keys or scheduled tasks shortly after execution, a pattern observed when adware wrappers stage ValleyRAT.
references:
  - https://attack.mitre.org/techniques/T1547/001/
  - https://attack.mitre.org/techniques/T1053/005/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.persistence
  - attack.t1547.001
  - attack.t1053.005
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains:
      - '\CurrentVersion\Run'
      - '\CurrentVersion\RunOnce'
  filter_common_installers:
    Image|endswith:
      - '\msiexec.exe'
      - '\svchost.exe'
      - '\msiexec64.exe'
  condition: selection and not filter_common_installers
falsepositives:
  - Legitimate software registering autostart entries (OneDrive, Teams, updaters)
  - Correlate with process lineage from %TEMP%, %Downloads%, or %AppData% to reduce noise
level: medium
---
title: Rundll32 or Signed Binary Loading DLL from Temp Path via Command Line
id: 5d8c3a90-2f6b-4e71-9c4d-8a1b6e3f5d27
status: experimental
description: Detects explicit DLL execution from user-writable paths via rundll32 or regsvr32, a fallback execution method seen in ValleyRAT staging chains.
references:
  - https://attack.mitre.org/techniques/T1218/011/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.defense_evasion
  - attack.t1218.011
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\rundll32.exe'
      - '\regsvr32.exe'
  selection_cli:
    CommandLine|contains:
      - '\AppData\Local\Temp\'
      - '\Users\Public\'
      - '\AppData\Roaming\'
      - '.tmp'
  condition: selection_img and selection_cli
falsepositives:
  - Rare legitimate installer cleanup routines
level: high

KQL — Microsoft Sentinel / Defender

This query hunts for the core sideloading signal: signed processes loading unsigned DLLs from user-writable locations, enriched with the process lineage so analysts can pivot quickly. Run it over 7 days and sort by rarity — first-seen FileName + FolderPath pairs are your highest-value leads.

let WritablePaths = dynamic([@"\AppData\Local\Temp\", @"\AppData\Roaming\", @"\Users\Public\", @"\ProgramData\", @"\Downloads\"]);
DeviceImageLoadEvents
| where TimeGenerated > ago(7d)
| where FolderPath has_any (WritablePaths)
| where FileName endswith ".dll"
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(7d)
    | project ProcessId=tostring(ProcessId), DeviceId, InitiatingProcessFileName, InitiatingProcessCommandLine, ProcessCommandLine, Signer=FileName
) on DeviceId, ProcessId
| summarize LoadCount = count(), Devices = dcount(DeviceId), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
    by FileName, FolderPath, InitiatingProcessFileName, SHA256
| where LoadCount < 10
| order by FirstSeen desc

Follow-on query for post-compromise network behavior — signed binaries (that have no business making outbound connections) talking to rare external IPs:

DeviceNetworkEvents
| where TimeGenerated > ago(3d)
| where InitiatingProcessFolderPath has_any (@"\AppData\", @"\ProgramData\", @"\Users\Public\")
| where RemoteIPType == "Public"
| summarize ConnCount = count(), RemoteIPs = make_set(RemoteUrl, 20), Ports = make_set(RemotePort)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessSHA256
| where ConnCount > 50
| order by ConnCount desc

Velociraptor VQL

Use this hunt artifact to sweep the fleet for unsigned DLLs sitting next to signed executables in writable directories — the physical artifact of a staged sideload pair — plus the persistence that keeps it alive.

-- Hunt for unsigned DLLs co-located with executables in user-writable paths,
-- and enumerate Run-key persistence pointing into those paths (ValleyRAT staging pattern)
LET dll_hits = SELECT FullPath, Size, Mtime,
       authenticode(Filename=FullPath) AS Authenticode
FROM glob(globs=['C:/Users/*/AppData/Roaming/**/*.dll',
                 'C:/Users/*/AppData/Local/Temp/*.dll',
                 'C:/ProgramData/**/*.dll',
                 'C:/Users/Public/*.dll'])
WHERE Authenticode.Trusted = 'untrusted'
  AND Size > 100000

SELECT FullPath AS SuspiciousDLL, Size, Mtime, Authenticode
FROM dll_hits

-- Pivot: persistence entries referencing writable paths
SELECT Name AS ValueName, FullPath AS KeyPath, data.value AS Command
FROM glob(globs=['HKEY_LOCAL_MACHINE/SOFTWARE/Microsoft/Windows/CurrentVersion/Run/*',
                 'HKEY_USERS/*/Software/Microsoft/Windows/CurrentVersion/Run/*'],
          accessor='registry')
WHERE Command =~ 'AppData|ProgramData|Public'

Remediation & Verification Script

Use this PowerShell to audit a suspect endpoint for sideload staging artifacts and persistence. Run it via your RMM/EDR live response, or adapt it into a fleet-wide sweep.

# ValleyRAT sideload triage — run elevated on suspect endpoints
# 1) Unsigned DLLs staged in writable directories
$paths = @("$env:ProgramData", "$env:PUBLIC", "$env:TEMP", "$env:APPDATA")
foreach ($p in $paths) {
  Get-ChildItem -Path $p -Recurse -Filter *.dll -ErrorAction SilentlyContinue |
    ForEach-Object {
      $sig = Get-AuthenticodeSignature $_.FullName
      if ($sig.Status -ne 'Valid') {
        [PSCustomObject]@{
          Path   = $_.FullName
          Size   = $_.Length
          Sig    = $sig.Status
          SHA256 = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
          Mtime  = $_.LastWriteTime
        }
      }
    }
}

# 2) Persistence pointing into writable paths
Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*',
                 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run*' -ErrorAction SilentlyContinue |
  Select-Object * | Out-String | Select-String -Pattern 'AppData|ProgramData|Public' -AllMatches
Get-ScheduledTask | Where-Object {
  $_.Actions.Execute -match 'AppData|ProgramData|Temp' -and
  $_.Actions.Execute -notmatch 'Microsoft|Windows'
} | Select-Object TaskName, TaskPath, @{N='Action';E={$_.Actions.Execute}}

# 3) Signed processes with anomalous unsigned loaded modules (live systems)
Get-Process | Where-Object {$_.Modules} | ForEach-Object {
  $proc = $_
  $proc.Modules | Where-Object {
    $_.FileName -match 'AppData|ProgramData|Temp|Public' -and
    (Get-AuthenticodeSignature $_.FileName).Status -ne 'Valid'
  } | Select-Object @{N='Process';E={$proc.ProcessName}}, @{N='PID';E={$proc.Id}}, FileName
}

Remediation

There is no patch because there is no CVE — remediation is architectural and behavioral:

1. Contain compromised hosts immediately. If the hunt above hits, isolate the endpoint, capture memory before reboot (the implant's decrypted payload lives there), and preserve the signed-binary/malicious-DLL pair for analysis. Assume credential theft: reset any credentials used on the host, including browser-stored passwords and session tokens.
2. Enforce application control. Deploy WDAC or AppLocker rules that restrict DLL loading to signed, expected paths. Microsoft's recommended driver/DLL block rules plus path-based restrictions on %APPDATA%, %TEMP%, and %PUBLIC% execution break this delivery model outright.
3. Stop treating PUP/adware detections as noise. Reclassify adware-with-installer alerts for mandatory triage. In this campaign, the adware is the delivery mechanism — closing those tickets without investigation is how Silver Fox gets dwell time.
4. Harden software acquisition. Block unauthorized software installation via policy; restrict browser downloads from unvetted portals; educate users that "free utility" installers from search ads are a primary Silver Fox funnel.
5. Tune EDR for sideload visibility. Ensure image-load telemetry (Sysmon Event ID 7 or EDR equivalent) is collected and forwarded. Many organizations collect process creation but not module loads — that blind spot is exactly what this campaign exploits.
6. Network egress filtering. ValleyRAT C2 typically originates from processes with no legitimate network need. Alert on any process executing from user-writable paths that establishes outbound connections to low-reputation or first-seen destinations.

The strategic lesson: when the malware rides inside a trusted, signed process, your perimeter and your signature engine are both blind. Behavioral detection on DLL load provenance, persistence, and anomalous process network activity is the control plane that matters.

Related Resources

Security Arsenal Incident Response Services AlertMonitor Platform Book a SOC Assessment incident-response Intel Hub