Backdoored Signal, LINE and Gmail Installers Target Chinese-Speaking Users

Feb 18, 2025 · Original article ↗

Summary

Fake software download pages targeting Chinese-speaking users distribute backdoored Windows executables that modify Windows Defender settings and connect to suspected command-and-control infrastructure.

Key points

Fraudulent download pages for Signal, LINE, Gmail, BitBrowser and Google Translate deliver malicious files, often through ZIP archives.
The pages use unrelated or generic domains rather than closely copying official software URLs; the researchers assess Chinese-speaking users as the likely target.
Analysis found a consistent execution chain that drops and runs files from temporary and AppData directories, with the malware identified as MicroClip by Joe Sandbox.
A spawned PowerShell command adds the entire C:\ drive to Windows Defender's exclusion path, weakening scanning.
The malware queried zhzcm.star1ine[.]com and made a TCP connection to 8.210.9[.]4 on port 45, potentially for command-and-control or data exfiltration.
The observed download domains were hosted on 47.243.192[.]62; the article includes domain, IP, file-hash and path indicators for defenders.
The authors recommend avoiding unofficial download sites and verifying software sources; the exact traffic-delivery method remains unclear.

Article Details

Attack Vectors: Fake software-download pages, likely promoted through search-engine manipulation, deliver ZIP archives containing backdoored Windows executables.
The executables extract temporary files, launch a nested payload, inject into a process, add a Windows Defender exclusion for C:\, and make outbound network connections.
Defensive Notes: Avoid downloading software from unofficial download sites and verify software sources before installing.
Monitor for suspicious PowerShell activity that adds broad Windows Defender exclusions, temporary-file extraction, process injection, and connections to the listed indicators.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`ai[.]wenxinzhineng[.]top`	Campaign infrastructure domain identified in a TLS certificate on the server hosting malicious download pages.
DOMAIN	`ffy[.]yadi98[.]top`	Host from which the malicious Flash-themed ZIP download was requested.
DOMAIN	`ggyxx[.]wenxinzhineng[.]top`	Fake Gmail page used to distribute a malicious ZIP archive.
DOMAIN	`goougekiut[.]com`	Listed as a campaign domain hosted on the server serving malicious download pages.
DOMAIN	`linegut[.]com`	Reported as hosting a malicious Line download page and previously distributing a ZIP archive.
DOMAIN	`linoo[.]wenxinzhineng[.]top`	Fake Line download page used to distribute a malicious ZIP archive.
DOMAIN	`sigkiti[.]com`	Malicious Google Translate-themed page that triggered a payload download.
DOMAIN	`xiaokgajia[.]com`	Listed as a domain associated with the server used for the malware's outbound network activity.
DOMAIN	`xxx1[.]dezhen[.]icu`	Listed as a campaign domain hosted on the server serving malicious download pages.
DOMAIN	`youdaoah[.]top`	Listed as a campaign domain hosted on the server serving malicious download pages.
DOMAIN	`youdaomjsyu[.]icu`	Listed as a campaign domain hosted on the server serving malicious download pages.
DOMAIN	`yyyaisiuy[.]com`	Listed as a campaign domain hosted on the server serving malicious download pages.
DOMAIN	`z1[.]xiaowu[.]pw`	Fake Signal download page used to distribute a malicious ZIP archive.
DOMAIN	`z2[.]xiaowu[.]pw`	Listed as a campaign domain hosted on the server serving malicious download pages.
DOMAIN	`zhiwen[.]wenxinzhineng[.]top`	Reported as a fake BitBrowser download page distributing a malicious ZIP archive.
DOMAIN	`zhzcm[.]star1ine[.]com`	Domain queried by the malware during DNS resolution.
DOMAIN	`zzz1[.]dezhen[.]icu`	Listed as a campaign domain hosted on the server serving malicious download pages.
IPV4	`47[.]243[.]192[.]62`	Host for the campaign's malicious download domains and webpages.
IPV4	`8[.]210[.]9[.]4`	Malware contacted this IP over TCP port 45, possibly for C2 or data exfiltration.
SHA256	`3d383f6d7187bcd9b060501acc89ed63326d8850ebb9405c80931e40bae7642e`	SHA-256 of the malicious Sriguoe-i4.exe executable.
SHA256	`74a12cea157878c04576fd8f775b4e42a980dd35135dbb5087988575880e76eb`	SHA-256 of the malicious Mueiqueur-4.exe executable.
SHA256	`8365be3173d13ef29027e9cc18fa9d2687ca66bcf71caddd9b71c0022b68a4ab`	SHA-256 of the malicious Levinech-en.exe executable.
SHA256	`8bad8e2da5a908099dad0365e29bf49bf4a630066bd04971cd8554618083306e`	SHA-256 of the malicious Goongeurut.zip archive.
SHA256	`9f2f18666c71ec41411340b6f794de2a9bcb499d64a1346d39b0ea5add53df78`	SHA-256 of the malicious Goongeurut.exe executable.
SHA256	`a1ef923faa490157923b1a6a52733644e7fa26a5a4d1d7684596ec57899b6e45`	SHA-256 of a malicious Mueiqueur-4.zip archive.
SHA256	`cc1dc9b0ee1216c94d62d9b2ce2221062dd0bf0d2fa482113714460da81611e6`	SHA-256 of the malicious Levinech-en.zip archive.
SHA256	`d032b410a052b155df3e8655eb39c330467480c4061f9c7214591bc119bd4fa1`	SHA-256 of the malicious Sriguoe-i4.zip archive.
SHA256	`d40df27a82c30187119e4e6fc20256722cf5991a40e4f6efdd29e33574aba750`	SHA-256 of a malicious Biutengobiru-i4.zip archive.
SHA256	`e8332e157b19a12be2babb1395e9e67c0db6c97ef7bccd8c09c860cb74e6afb3`	SHA-256 of a malicious Biutengobiru-i4.zip archive.