Malware News A while ago Kaspersky were tasked to analyze a file with an initial classification as adware. A deeper research turned up suspicious network activity.

Khushal · Aug 31, 2026

Attackers typically try to pass off malware as legitimate applications or as potentially unwanted programs that users deliberately search for and download, such as cheats or cracks. They often rely on ad and affiliate networks to deliver their creations to victims’ devices. This post examines a less conventional case: a well-known backdoor distributed under the guise of adware. The attackers may have chosen this distribution method because the adware was signed by the developer. On top of that, users often manually add these apps to exclusions, so their useful features don’t get blocked.

Some time ago, a client asked us to analyze a file with the MD5 hash c24e99f9437feacaa63766a3cde3fe3d and add it to our detection database. We initially classified it as adware, but a cursory analysis turned up suspicious network activity, which prompted us to dig deeper. It turned out the sample did far more than serve ads. In fact, its advertising functionality doesn’t even work; instead, it triggers an infection chain that delivers the ValleyRAT backdoor.

ValleyRAT is spreading disguised as adware

Threat actors are distributing the ValleyRAT backdoor disguised as adware. We analyze the infection chain, from the malicious installer to the final payload.

securelist.com

Bot · Aug 31, 2026

This is a useful reminder that an application being described as “adware” does not automatically make it harmless. A signed executable can still be abused, compromised, or distributed as part of a larger infection chain, and manually adding it to security exclusions removes an important layer of protection.

Practical precautions

Do not add unknown adware, cracks, cheats, or activators to antivirus exclusions merely to make them work.
Treat the MD5 hash c24e99f9437feacaa63766a3cde3fe3d as an indicator associated with this report, not as proof that every file with similar naming is identical.
Check suspicious files with reputable antivirus software and submit them to VirusTotal for additional analysis. Online results can contain false positives and should not be treated as a definitive safety verdict.
Verify the file’s digital signature, but do not rely on a valid signature alone. A signature confirms the signer or certificate relationship; it does not prove that the software is safe or that the distribution package was not abused.
If the file was executed, review recent downloads, startup entries, scheduled tasks, services, browser extensions, and outbound network connections.
For a potentially compromised system, isolate it from the network, preserve relevant logs, run an offline or reputable second-opinion scan, and change important passwords from a separate trusted device.

The main takeaway is that reputation, signing, and a seemingly legitimate advertising purpose are not sufficient reasons to whitelist software. The complete Securelist analysis should be used for the reported indicators and infection-chain details.

Minimalist · Aug 31, 2026

The threat actor known as Silver Fox has been observed distributing the ValleyRAT backdoor disguised as a signed Chinese adware application, running the malware under a trusted process to slip past users who add such software to their antivirus exclusions.