cyber.hendryadrian.com
Threat Research · cyfirma.com

CYFIRMA Details Tax-Themed Phishing Campaign Delivering In-Memory Malware

· Original article ↗

Summary

CYFIRMA analyzes Operation TaxShadow, a tax-themed phishing campaign delivering staged Windows malware via a fake portal and ZIP archive. It details DLL hijacking, token manipulation, in-memory loading and WebSocket C2; attribution remains moderate-confidence.

Key points

  • The report describes fraudulent tax-notification emails redirecting targets to fake Indian and Japanese tax portals, which offered a malicious ZIP archive.
  • The archive contained a loader executable, SbieDll.dll and SbieDll.bin; the report says the DLL used search-order hijacking to load the malicious component.
  • Analysis describes API hooks and token manipulation, COM callback execution, and a Mersenne Twister-based dispatcher as part of the malware’s evasion behavior.
  • The encrypted payload was decrypted and loaded in memory using reflective PE loading; the report also details mutated RC4 and LLVM-based control-flow flattening.
  • The malware established persistent WebSocket C2 and supported HTTP CONNECT proxy communication; dynamic analysis observed communication with 43.128.54.184 over port 1234.
  • The report found shared infrastructure hosting Indian- and Japanese-themed phishing pages and Chinese-language artifacts, but says attribution remains at moderate confidence.

Article Details

Attack Vectors
  • A fraudulent tax-notification email impersonated an Indian government tax authority and included a link to phishing infrastructure.
  • The phishing site imitated tax portals and prompted victims to download a malicious ZIP archive containing कर विवरण.exe, SbieDll.dll, and SbieDll.bin; execution depended on extracting and launching the executable.
  • The malware used DLL Search Order Hijacking to load the malicious SbieDll.dll, then decrypted the SbieDll.bin payload and reflectively loaded it in memory.
  • During observed execution, the malware injected into svchost.exe and mitmweb.exe and established WebSocket communication with 43.128.54.184 over port 1234. HTTP CONNECT support indicated proxy awareness.
Defensive Notes
  • Train users to recognize government-impersonation emails, urgent tax-related lures, malicious links, and unexpected ZIP attachments.
  • Use email security controls and domain-reputation monitoring to identify spoofed sender identities and phishing infrastructure.
  • Monitor for DLL Search Order Hijacking, API hooking, token manipulation, reflective PE loading, and unusual process injection.
  • Use network IDS and proxy monitoring to investigate suspicious HTTP-to-WebSocket upgrades, HTTP CONNECT activity, and unusual outbound connections.
  • Enable endpoint and memory monitoring, and include phishing-based intrusions, malicious DLL execution, and multi-stage payload behavior in threat hunts.

Indicators of compromise

TypeIndicatorContext
DOMAINappradarr[.]ccListed as a campaign infrastructure domain and marked for blocking.
DOMAINasdqxcdsa[.]icuListed as a campaign infrastructure domain and marked for blocking.
DOMAINguhxmg[.]comListed as a campaign phishing or infrastructure domain and marked for blocking.
DOMAINmnb-ny[.]comIdentified in the phishing email analysis as the attacker-controlled domain underlying the spoofed sender identity.
DOMAINnaiqja[.]icuListed as a campaign phishing or infrastructure domain and marked for blocking.
DOMAINws4962[.]comListed as a campaign infrastructure domain and marked for blocking.
DOMAINzh-welcome-1xbet[.]comListed as a campaign infrastructure domain and marked for blocking.
DOMAINzhengfu666[.]comListed as a campaign infrastructure domain and marked for blocking.
HOSTNAMEd[.]pc-weide[.]comListed as a hostname hosting tax-themed impersonation content or related campaign infrastructure; marked for blocking.
HOSTNAMEtaxations[.]cn-web-okooo[.]comListed as a hostname hosting tax-themed impersonation content or related campaign infrastructure; marked for blocking.
HOSTNAMEtaxations[.]indiagov[.]it[.]comListed as a campaign phishing or infrastructure hostname and marked for blocking.
IPV443[.]128[.]54[.]184External endpoint contacted by the malware; the report identifies it as command-and-control or remote communication infrastructure.
MD53a8f6454927b8993aded75de0de2bd00Identified as the MD5 hash of the initial executable sample कर विवरण.exe.
MD5b498256cb086a6962077cdd6d2f65327Identified as the MD5 hash of the encrypted shellcode component SbieDll.bin.
MD5e83ff54e58f0b295a392c7fc39a7d0deIdentified as the MD5 hash of the malicious loader DLL SbieDll.dll.
SHA256185b7a487316454da04e9cc0fe6eb370bb2955cf6096fe3e8c02c46f8989ba37Listed as a malware or related sample hash for detection and blocking.
SHA2564c9061a07d667bf7dd6f597a43a8552af2f4277b7be06d6ea138abdb668d6a49Listed as a malware or related sample hash for detection and blocking.
SHA2567d87a86dbd2379ef2516c99258137cd9c25ca19c48aeb096c5332c02fcbf16d0Listed as a malware or related sample hash for detection and blocking.
SHA256949acbe543fc244ffbc981ea169067da7c5792af3c3d19b2c31b3d7e19106880Listed as a malware or related sample hash for detection and blocking.
SHA256be31a63cad112723178289968ad6f93a576c5a7984099c42eec3521cdf6e5fc0Listed as a malware or related sample hash for detection and blocking.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe malware used mutated RC4, Control Flow Flattening, and dynamic execution logic to obfuscate its payload and behavior.T1036 · MasqueradingThe initial executable used deceptive localized naming to appear legitimate.T1055 · Process InjectionObserved execution included process injection into svchost.exe and mitmweb.exe.T1071.001 · Web ProtocolsThe malware used HTTP-based WebSocket communication for command and control.T1082 · System Information DiscoveryThe loader checked the Windows version and environment before proceeding.T1090 · ProxyHTTP CONNECT functionality indicated that the malware could communicate through enterprise proxies.T1134 · Access Token ManipulationHooks on SetThreadToken() and GetTokenInformation() manipulated tokens and impersonation contexts.T1140 · Deobfuscate/Decode Files or InformationThe malware decrypted the encrypted payload in SbieDll.bin at runtime before execution.T1204.002 · Malicious FileExecution required victims to extract the ZIP archive and launch कर विवरण.exe.T1566.002 · Spearphishing LinkThe campaign used a tax-themed phishing email containing a malicious link to phishing infrastructure.T1573 · Encrypted ChannelThe report describes the malware's WebSocket-based communication sessions as encrypted.T1574.001 · DLLThe malware used DLL Search Order Hijacking to load the malicious SbieDll.dll in place of a legitimate library.T1620 · Reflective Code LoadingThe loader manually reconstructed and executed the decrypted PE payload in memory without using LoadLibrary().

Vendors

SendGridThe email delivery path additionally shows routing through SendGrid’s outbound infrastructure, indicating the use of a legitimate third-party email delivery service for improved delivery reliability and reduced

Products

Sandboxie[T1553 ] Subvert Trust Controls – The malware abused trusted Sandboxie-related components and legitimate mechanisms for concealment (‘abused trusted Sandboxes DLL mechanisms and legitimate components’).

Tools

Astral-PEThe extracted strings confirmed that the malware sample was obfuscated using the Astral-PE obfuscation tool.Detect It EasyFigure 6: Static analysis results of कर विवरण.exe using Detect It Easy (DiE) showing PE64 architecture, Visual Studio compilation artifacts, debug information, and overlay structures, indicating its roleIDA ProSuch techniques disrupt IDA Pro graph reconstruction, reduce the effectiveness of signature-based detection, and complicate behavioural analysis, as analysts cannot easily identify the original execution sequence.SigmaDeploy Enhanced Detection Rules: Implement YARA, Sigma, and EDR detection rules to monitor indicators associated with DLL Search Order Hijacking, API Hooking, Reflective PE Loading, token manipulation, andYARADeploy Enhanced Detection Rules: Implement YARA, Sigma, and EDR detection rules to monitor indicators associated with DLL Search Order Hijacking, API Hooking, Reflective PE Loading, token manipulation, and

Countries

Japansame suspicious infrastructure previously used for Indian tax-themed phishing activity is now hosting a Japan-themed government impersonation portal, suggesting infrastructure reuse by the threat operators.

Industries

GovernmentThis report details an Indian tax-themed phishing campaign that used government impersonation, a fake tax portal, and a malicious ZIP archive to deliver a multi-stage malware framework.

Related Articles