Seqrite Details Operation GriefLure Spear-Phishing Campaign in Vietnam and the Philippines
Summary
Seqrite Labs describes Operation GriefLure, a spear-phishing campaign targeting Viettel-linked personnel in Vietnam and St. Luke’s Medical Center in the Philippines, and analyzes its LNK/ftp.exe loader, DLL sideloading, RAT capabilities and C2.
Key points
- Seqrite Labs reported targeting of Viettel Group executives and investigators in Vietnam and St. Luke’s Medical Center personnel in the Philippines.
- The campaign used spear-phishing archives containing malicious LNK files and decoys; one campaign used authentic legal documents, while another used a fabricated whistleblower complaint.
- The LNK files abused ftp.exe and batch scripts to assemble sfsvc.exe and 360.dll from .doc fragments, with time-based payload selection.
- Seqrite analyzed sfsvc.exe as a modular DLL execution framework and 360.dll as a shellcode loader that can inject code into explorer.exe.
- The analyzed second-stage payload had RAT capabilities including persistence, reconnaissance, screenshots, and collection of files and credentials.
- The malware communicated over HTTPS with XOR-obfuscated data; reported infrastructure included whatsappcenter[.]com and 38.54.122.188.
- Seqrite assessed a China-nexus threat cluster with moderate-to-high confidence, citing infrastructure, targeting, China-specific security-product checks, and WeChat data targeting. This is the report’s attribution assessment.
Article Details
- Attack Vectors
- Spear-phishing emails delivered nested RAR or ZIP archives containing malicious LNK files and decoy PDFs. The lures used authentic Viettel-related legal documents or a fabricated St. Luke’s Medical Center complaint.
- The LNK files invoked native ftp.exe and hidden batch scripts. The scripts concatenated payload fragments disguised as .doc files to assemble and silently launch sfsvc.exe and a time-selected 360.dll.
- sfsvc.exe loaded 360.dll through DllRegisterServer. The DLL decoded and executed shellcode in memory, then injected a payload into explorer.exe.
- The second-stage RAT used HTTPS C2 with XOR-obfuscated data and supported reconnaissance, credential collection, screenshot capture, and chunked file transfer.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | www[.]whatsappcenter[.]com | C2 domain used by the malware, described as masquerading as a legitimate-looking service. |
| IPV4 | 38[.]54[.]122[.]188 | Server hosting the campaign’s C2 domain and identified in the article as associated infrastructure. |
| SHA256 | 197f11a7b0003aa7da58a3302cfa2a96a670de91d39ddebc7a51ac1d9404a7e6 | SHA-256 hash listed for a campaign LNK file named as a Philippine national ID document. |
| SHA256 | 35af2cf5494181920b8624c7b719d39590e2a5ff5eaa1a2fa1ba86b2b5aa9b43 | SHA-256 hash listed for the malicious Viettel-themed LNK file. |
| SHA256 | 61e9d76f07334843df561fe4bac449fb6fdaed5e5eb91480bded225f3d265c5f | SHA-256 hash listed for the dropped th5znehec.exe payload. |
| SHA256 | 7f80add94ee8107a79c87a9b4ccbd33e39eccd1596748a5b88629dd6ac11b86d | SHA-256 hash listed for a batch file used in the campaign. |
| SHA256 | 91a15554ec9e49c00c5ca301f276bd79d346968651d54204743a08a3ca8a5067 | SHA-256 hash listed in the campaign’s file-name and hash table. |
| SHA256 | a49155df50963d2412534090bbd967749268bd013881ddb81d78b87f91cdc15d | SHA-256 hash listed for a batch file used in the campaign. |
| SHA256 | bc090d75f51c293d916c40d4b21094faaec191a42d97448c92d264875bf1f17b | SHA-256 hash listed for the malicious St. Luke’s Medical Center-themed LNK file. |
| SHA256 | bc83817c6d2bf8df1d58eac946a12b5e2566b2ffe15cf96f37c711c4b755512b | SHA-256 hash listed for the dropped 360.8.dll payload. |
| SHA256 | ee6330870087f66a237a7f7c115b65beb042299f12eae1e9004e016686d0c387 | SHA-256 hash listed for the dropped a.dll payload. |
| SHA256 | f34f550147c2792c1ff2a003d15be89e5573f0896c5aa6126068baa4621ef416 | SHA-256 hash listed for a campaign LNK file named as a confidential iPad document. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationNested archives and payload fragments disguised as .doc files concealed the assembled executable and DLL.T1027.014 · Polymorphic CodeThe batch framework selected a time-dependent payload fragment, producing a differently hashed 360.dll on each execution.T1036 · MasqueradingBinary payload chunks were named and presented as .doc files.T1041 · Exfiltration Over C2 ChannelThe malware transmitted collected profiling information and screenshots to its C2 server.T1055.001 · Dynamic-link Library InjectionThe DLL wrote payload data into explorer.exe with WriteProcessMemory and executed it using CreateRemoteThread.T1059.003 · Windows Command ShellBatch scripts used Windows command-shell commands, including copy /b, to assemble and launch payloads.T1071.001 · Web ProtocolsThe malware used WinHTTP to send C2 requests over HTTPS.T1113 · Screen CaptureThe second-stage malware captured screenshots of the victim’s screen for transmission to its C2 server.T1204.002 · Malicious FileThe execution chain began when a recipient opened or executed a malicious LNK file.T1218 · System Binary Proxy ExecutionThe LNK execution chain abused native ftp.exe to run a hidden script as a loader.T1555.003 · Credentials from Web BrowsersThe malware targeted Chrome credential artifacts, including Login Data and Cookies.T1564.004 · NTFS File AttributesThe malware wrote a decoded payload to an NTFS Alternate Data Stream, with the article giving C:UsersPublicUpdate:2.dll as an example.T1566.001 · Spearphishing AttachmentSpear-phishing emails delivered archives containing the campaign’s malicious LNK files.T1573 · Encrypted ChannelThe article describes XOR obfuscation of malware network data using a static key.T1574.002 · DLL Side-Loadingsfsvc.exe loaded 360.dll and called its DllRegisterServer export as part of the DLL sideloading chain.
People
Vendors
Products
Countries
ChinaInfrastructure and targeting indicators suggested a China-nexus threat cluster using bulletproof hosting and a domain masquerading as a legitimate service.Hong KongThe host sits within KAOPU-HK Kaopu Cloud HK Limited (AS138915), a Hong Kong-based autonomous system with a well-documented history of providing abuse-resistant hosting to threat actors operating across the Asia-PacificPhilippinesLuke’s Medical Center in the Philippines that used real or highly convincing decoy documents to trigger execution.VietnamSeqrite Labs reported Operation GriefLure, a targeted spear-phishing campaign against Viettel Group in Vietnam and St.