Kong RAT Campaign Uses SEO Poisoning to Target Chinese-Speaking Developers
Summary
eSentire describes a multi-stage Kong RAT campaign that used SEO-poisoned software download sites to target Chinese-speaking developers. Its analysis details the malware’s evasion, persistence, keylogging and modular C2 capabilities.
Key points
- Lookalike download sites for tools including FinalShell, Xshell, QuickQ and Clash reportedly delivered trojanized installers hosted on Alibaba Cloud Object Storage.
- The reported six-stage chain progresses from a .NET NativeAOT dropper through in-memory DLL loading, DLL sideloading and shellcode execution to Kong RAT.
- Evasion and persistence include PEB masquerading, a CMSTPLUA COM UAC bypass, EnumWindows callback shellcode execution and scheduled tasks created through direct RPC.
- Kong RAT can log keystrokes, enumerate security products and messaging apps, and load remote plugins through a custom MPK1 protocol over TCP port 5947.
- The malware reportedly collects victim IP and geographic information through a LeTV CDN request and sends system information to its C2.
- eSentire says its analysts isolated an affected host and are developing detection content; it also recommends verifying software download sources and hunting for the listed persistence artifacts.
Article Details
- Attack Vectors
- SEO poisoning promoted Chinese-language lookalike software download sites, which delivered trojanized installers to users seeking developer and network tools.
- The infection chain used a .NET NativeAOT dropper to download staged payloads, load a DLL reflectively, and set up a Microsoft-signed executable to sideload a malicious DLL.
- The sideloaded DLL loaded shellcode from a disguised file and executed it through an EnumWindows callback; a later stage launched Kong RAT.
- Kong RAT used a custom TCP command-and-control protocol to receive plugins and commands, including remote command execution and file delivery.
- The malware collected keystrokes, enumerated security products and installed applications, and sent victim system and geolocation information to its operators.
- Defensive Notes
- Navigate directly to official software vendor websites rather than relying on search results, and train employees to recognize fake software-download sites.
- Hunt for the described scheduled-task, registry, and installation-path artifacts, as well as DLL sideloading and shellcode execution behavior.
- Block the malicious infrastructure identified in the article and monitor for the malware's command-and-control and staged-payload activity.
- eSentire reports that its analysts isolated the affected host and assisted the customer with remediation; its Threat Response Unit was developing detection content for endpoint, log, and network monitoring.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | clash-cn[.]com | Lookalike Clash download site identified as part of the malicious campaign infrastructure. |
| DOMAIN | finalshell-ssh[.]com | Lookalike FinalShell download site used to deliver a trojanized installer. |
| DOMAIN | letsv-vpn[.]com | Lookalike LeTV VPN site identified as part of the malicious campaign infrastructure. |
| DOMAIN | quickq-cn[.]com | Lookalike QuickQ download site identified as part of the malicious campaign infrastructure. |
| DOMAIN | x[.]x-x[.]icu | Kong RAT command-and-control domain used for TCP communications on port 5947. |
| DOMAIN | xshell-38m[.]pages[.]dev | Lookalike Xshell site identified as part of the malicious campaign infrastructure. |
| DOMAIN | xshell-cn[.]com | Lookalike Xshell download site identified as part of the malicious campaign infrastructure. |
| IPV4 | 45[.]192[.]208[.]126 | Reported Kong RAT command-and-control infrastructure associated with TCP port 5947. |
| SHA256 | 2b7d31a83ff817be7bdd6e9cf92dea438ca97dc93ea84cbf048f8656f7dd57dd | SHA-256 hash of the malicious rcdll.dll sideloading component. |
| SHA256 | 3a1dd72dd2dec21d18b8fcd72d221f069fed2d35c2bf4cdf042c9ae722d6c820 | SHA-256 hash reported for the downloaded zj.mp4 Windows DLL payload. |
| SHA256 | 736b2c5782fca75a85379181bcf1d3a719a14cacd938d053c03b16041059dd8f | SHA-256 hash of Setupexe.exe, the Microsoft-signed binary used to sideload the malicious DLL. |
| SHA256 | ae160034478a340421e20dc7c8fdee626cc3b8035d278f0a94afaf31766eea48 | SHA-256 hash of the zj.bin payload saved as oob.xml, containing shellcode and an embedded PE. |
| SHA256 | d6620d753e746e63b59e1e47943be5093f24fd3f82e994115cadeea3720f1aea | SHA-256 hash of the Setup.exe initial dropper. |
| SHA256 | ed68397183e72e7113c8ac4aceddf2051abf55d7c62b6fa69f62cbda11324ab8 | SHA-256 hash of the embedded Kong RAT executable. |
| URL | hxxps[:]//kkwinapp[.]oss-cn-hongkong[.]aliyuncs[.]com/dow/1.d11 | Campaign payload URL used to deliver the DLL sideloading component. |
| URL | hxxps[:]//kkwinapp[.]oss-cn-hongkong[.]aliyuncs[.]com/dow/upload?log= | Campaign endpoint used to send installation progress telemetry to the operators. |
| URL | hxxps[:]//kkwinapp[.]oss-cn-hongkong[.]aliyuncs[.]com/dow/zj.bin | Campaign payload URL used to deliver shellcode and an embedded Kong RAT payload. |
| URL | hxxps[:]//kkwinapp[.]oss-cn-hongkong[.]aliyuncs[.]com/dow/zj[.]mp4 | Payload URL used to deliver a Windows DLL disguised with an MP4 extension. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe dropper used NativeAOT compilation and the shellcode used stack-string obfuscation to hinder analysis.T1036.005 · Match Legitimate Resource Name or LocationDuring the elevation bypass, the malware changed PEB process parameters to make the process appear to be explorer.exe.T1047 · Windows Management InstrumentationThe malware used WMI queries to enumerate installed security products and obtain operating-system information.T1053.005 · Scheduled TaskThe dropper created a Windows scheduled task through direct RPC calls for persistence.T1055 · Process InjectionThe chain used reflective PE loading and executed shellcode from memory through an EnumWindows callback.T1056.001 · KeyloggingKong RAT captured keystrokes using GetAsyncKeyState and wrote them to local log files.T1059.003 · Windows Command ShellA C2 command executed operator-supplied commands through cmd.exe /c.T1071 · Application Layer ProtocolKong RAT communicated with its C2 over TCP using a custom MPK1 protocol on port 5947.T1105 · Ingress Tool TransferThe dropper downloaded staged payloads, and the C2 server delivered additional plugin modules.T1112 · Modify RegistryThe malware stored C2 configuration, session state, and plugin data under HKCU registry keys.T1189 · Drive-by CompromiseSEO poisoning directed users to lookalike software download sites that delivered trojanized installers.T1204 · User ExecutionThe initial infection required victims to download and run the trojanized installer.T1518.001 · Security Software DiscoveryThe malware queried the Windows SecurityCenter2 WMI namespace for installed antivirus products.T1548 · Abuse Elevation Control MechanismThe malware triggered a runas elevation prompt and later used a CMSTPLUA COM elevation bypass.T1574.001 · DLLThe campaign placed malicious rcdll.dll beside a Microsoft-signed rc.exe binary to trigger DLL sideloading.
Malware
Vendors
Alibaba Cloudthat used SEO poisoning to lure Chinese-speaking developers to trojanized installers hosted on Alibaba Cloud OSS, then progressed through a NativeAOT dropper, in-memory DLLs, DLL sideloading of aLeTVshellcode, scheduled task RPC creation) and harvests telemetry including victim geolocation via the LeTV CDN.Microsofton Alibaba Cloud OSS, then progressed through a NativeAOT dropper, in-memory DLLs, DLL sideloading of a Microsoft-signed binary, shellcode execution, and a modular TCP C2 framework.
Products
ClashInitial access via SEO poisoning: lookalike Chinese-language download sites (FinalShell, Xshell, QuickQ, Clash) redirect victims to trojanized installers served from Alibaba Cloud OSS (oss-cn-hongkong.aliyuncs.com).FinalShell#KongRAT #FinalShellLeTV media playerThe malware abuses the legitimate LeTV CDN (g3.letv.com/r?format=1) by impersonating a LeTV media player (LetvClient/1.0) to collect the victim’s public IP address and geographic description, giving the operatorMicrosoft Resource Compilerrc.exe (Microsoft Resource Compiler)QuickQ VPNInitial access via SEO poisoning: lookalike Chinese-language download sites (FinalShell, Xshell, QuickQ, Clash) redirect victims to trojanized installers served from Alibaba Cloud OSS (oss-cn-hongkong.aliyuncs.com).XshellInitial access via SEO poisoning: lookalike Chinese-language download sites (FinalShell, Xshell, QuickQ, Clash) redirect victims to trojanized installers served from Alibaba Cloud OSS (oss-cn-hongkong.aliyuncs.com).
Tools
dnSpyThe dropper (Setup.exe) is compiled using .NET 10.0 NativeAOT, a deliberate choice to defeat standard .NET reverse engineering tools (dnSpy, ILSpy) as NativeAOT compiles C# directly to native machine code.ILSpyThe dropper (Setup.exe) is compiled using .NET 10.0 NativeAOT, a deliberate choice to defeat standard .NET reverse engineering tools (dnSpy, ILSpy) as NativeAOT compiles C# directly to native machine code.