Silver Fox Uses Tax-Themed Phishing to Deploy Valley RAT in India
Summary
CloudSEK analyzes a Silver Fox campaign targeting India with tax-themed phishing emails that deliver Valley RAT through a multi-stage infection chain, DLL hijacking, process injection, and tiered command-and-control infrastructure.
Key points
- Victims receive an email with a tax-themed PDF attachment; opening it leads to a site that downloads a malicious executable.
- The installer drops a legitimate signed Thunder.exe alongside a malicious DLL, which is loaded through DLL search-order hijacking.
- The DLL uses anti-analysis checks, decrypts a payload, and injects shellcode into explorer.exe; a Donut loader then launches Valley RAT.
- Valley RAT supports keylogging, remote shell access, file transfer, and additional plugins, with configuration and plugins stored in the Windows registry.
- The RAT uses tiered C2 infrastructure, HTTP/HTTPS or raw TCP, delayed beaconing, and failover between servers.
- CloudSEK recommends monitoring suspicious registry blobs, executable memory allocation and thread creation, and signed binaries loading unsigned DLLs from temporary directories.
Article Details
- Attack Vectors
- An income-tax-themed phishing email delivered a PDF attachment; opening it led to a browser visit to ggwk[.]cc and download of a ZIP containing tax affairs.exe.
- The installer dropped Thunder.exe and a malicious libexpat.dll; the signed executable loaded the DLL from its local directory through DLL search-order hijacking.
- The DLL decrypted shellcode from box.ini and injected it into a suspended explorer.exe process; Valley RAT later used process hollowing to inject plugins into tracerpt.exe.
- Valley RAT communicated with tiered C2 infrastructure over HTTP/HTTPS or raw TCP and could receive plugins and modules from the C2 servers.
- Defensive Notes
- Monitor executable REG_BINARY data and anomalous registry values under paths such as HKCU\Console\*.
- Detect retry-heavy outbound connections, protocol switching, delayed initial beacons, and failover behavior across C2 tiers.
- Alert on processes allocating PAGE_EXECUTE_READWRITE memory followed by thread creation, particularly in explorer.exe.
- Correlate signed binaries launched from temporary directories with unsigned local DLL loads and subsequent thread creation.
- Monitor for keylogging APIs, interactive shell behavior, or file-transfer activity in long-running processes.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | 2025swmm[.]cn | Domain listed as Silver Fox infrastructure. |
| DOMAIN | b[.]yuxuanow[.]top | Primary shellcode C2 domain identified by the report. |
| DOMAIN | dingtalki[.]cn | Domain listed as Silver Fox infrastructure. |
| DOMAIN | ggwk[.]cc | Malicious domain embedded in the decoy attachment and used to deliver the ZIP payload. |
| DOMAIN | gov-a[.]club | Domain listed as Silver Fox infrastructure. |
| DOMAIN | gov-a[.]fit | Domain listed as Silver Fox infrastructure. |
| DOMAIN | gov-a[.]work | Domain identified as a rotating C2 tier and listed as Silver Fox infrastructure. |
| DOMAIN | gov-c[.]club | Domain listed as Silver Fox infrastructure. |
| DOMAIN | govk[.]club | Domain listed as Silver Fox infrastructure. |
| DOMAIN | gvo-b[.]club | Domain listed as Silver Fox infrastructure. |
| DOMAIN | hhiioo[.]cn | Domain listed as Silver Fox infrastructure. |
| DOMAIN | hhiioo[.]work | Domain listed as Silver Fox infrastructure. |
| DOMAIN | hhimm[.]work | Domain listed as Silver Fox infrastructure. |
| DOMAIN | itdd[.]club | Domain listed as Silver Fox C2 infrastructure found during pivoting. |
| DOMAIN | kkyui[.]club | Domain listed as Silver Fox infrastructure. |
| DOMAIN | swjc2025bjkb[.]cn | Domain listed as Silver Fox infrastructure. |
| DOMAIN | xzghjec[.]com | Domain listed as a rotating C2 tier and as Silver Fox infrastructure. |
| IPV4 | 103[.]20[.]195[.]147 | IP address associated with the primary shellcode C2 domain b[.]yuxuanow[.]top. |
| IPV4 | 160[.]124[.]9[.]103 | IP address associated in the infrastructure table with multiple listed Silver Fox C2 domains. |
| IPV4 | 43[.]100[.]123[.]207 | IP address associated in the infrastructure table with swjc2025bjkb[.]cn and 2025swmm[.]cn. |
| IPV4 | 43[.]100[.]22[.]158 | IP address associated in the infrastructure table with hhiioo[.]cn and other listed Silver Fox domains. |
| IPV4 | 43[.]100[.]63[.]145 | IP address listed alongside hhiioo[.]work in the Silver Fox infrastructure table. |
| IPV4 | 45[.]207[.]231[.]107 | IP address listed alongside itdd[.]club in the Silver Fox infrastructure table. |
| IPV4 | 45[.]207[.]231[.]94 | IP address reported as resolving from the malicious domain ggwk[.]cc. |
| IPV4 | 47[.]239[.]225[.]43 | IP address listed alongside dingtalki[.]cn in the Silver Fox infrastructure table. |
| IPV4 | 8[.]217[.]9[.]165 | IP address listed alongside xzghjec[.]com in the Silver Fox infrastructure table. |
| SHA256 | 068e49e734c2c7be4fb3f01a40bb8beb2d5f4677872fabbced7741245a7ea97c | Stage 4 file hash listed in the report's IOCs. |
| SHA256 | 77ea62ff74a66f61a511eb6b6edac20be9822fa9cc1e7354a8cd6379c7b9d2d2 | Stage 1 file hash listed in the report's IOCs. |
| SHA256 | f74017b406e993bea5212615febe23198b09ecd73ab79411a9f6571ba1f94cfa | Stage 3 file hash listed in the report's IOCs. |
| SHA256 | fa388a6cdd28ad5dd83acd674483828251f21cbefaa801e839ba39af24a6ac19 | Stage 2 file hash listed in the report's IOCs. |
MITRE ATT&CK
T1008 · Fallback ChannelsThe RAT uses three C2 tiers and switches between them after repeated connection failures.T1027 · Obfuscated Files or InformationThe payload in box.ini is encrypted and decrypted at runtime.T1056.001 · KeyloggingValley RAT can enable keylogging through its kl configuration flag.T1057 · Process DiscoveryThe DLL enumerates processes to identify analysis and sandbox tools.T1071.001 · Web ProtocolsValley RAT supports HTTP/HTTPS C2 communication.T1095 · Non-Application Layer ProtocolValley RAT supports raw TCP socket C2 communication.T1105 · Ingress Tool TransferValley RAT downloads plugins and modules from its C2 server.T1106 · Native APIThe installer and malware use native APIs including GetTempPathA, VirtualAllocEx, and WriteProcessMemory.T1112 · Modify RegistryValley RAT stores configuration and plugin data as registry values, including REG_BINARY data.T1129 · Shared ModulesThe legitimate Thunder.exe executable loads the malicious libexpat.dll from its local path.T1204.002 · Malicious FileOpening the PDF led to the malicious domain and a ZIP payload download.T1218 · System Binary Proxy ExecutionThe infection chain abuses the legitimate, digitally signed Thunder.exe binary as a DLL-loading host.T1489 · Service StopThe malware disables the Windows Update service.T1497 · Virtualization/Sandbox EvasionThe DLL uses anti-debugging, system-resource checks, and sandbox detection before continuing.T1566.001 · Spearphishing AttachmentAn income-tax-themed PDF attachment was delivered by email.T1574.001 · DLLThunder.exe loads the malicious libexpat.dll from its local directory through DLL search order.T1620 · Reflective Code LoadingDonut-generated shellcode is executed from memory.
Threat Actors
Malware
Products
Microsoft WindowsIf the operation fails, it falls back to C:\Windows\Temp, ensuring execution reliability. Once a valid location is identified, the installer creates an NSIS specific working directory (~nsu.tmp) and switches theThunder.exeDropped FilesUpon analysis we found that only 2 files are of use to us, Thunder.exe and libexpat.dll.Windows Updatethe DLL completes its anti analysis checks, it enters the core execution logic. It first disables the Windows Update service(wuauserv) then loads an encrypted payload from the disk. The payload is dynamically resolved
Tools
Detect It EasyDonutDecrypted PayloadLooking through the decrypted payload we find that the final payload is a Donut generated shellcode.donut-decryptorDonutLoaderWe can dump the Donut payload by using tools like undonut or donut-decryptor .undonutDonutLoaderWe can dump the Donut payload by using tools like undonut or donut-decryptor .x64dbgWe can confirm this in x64dbg.