cyber.hendryadrian.com
Threat Research · dti.domaintools.com

Silver Fox-Linked Malware Network Expands as Researchers Detail Gh0stRAT Delivery

· Original article ↗

Summary

DomainTools reports that a malware delivery network linked to Silver Fox remained active after reported arrests, registering over 400 domains. Researchers detail its spoofed software lures, abused hosting services, and Gh0stRAT infection chains.

Key points

  • More than 400 malicious domains were registered between June 17 and 27, 2026, after reported arrests of people connected to Silver Fox operations.
  • The infrastructure appears to serve multiple affiliates, with distinct operators using different hosting and targeting financial, enterprise, VPN, cloud-storage, and AI software users.
  • Payloads are distributed through spoofed software sites and abused services including cloud storage, GitHub release assets, and Microsoft Store redirects.
  • The main infection chain uses oversized installers, OLLVM and other obfuscation, a UAC bypass, and reflective DLL injection to deliver Gh0stRAT.
  • The malware can capture screens, log keystrokes, enumerate systems, collect data from messaging apps and browsers, and maintain persistence through services and a watchdog.
  • A secondary Gh0stRAT chain uses DLL sideloading and a valid Authenticode-signed DLL; the article also provides file hashes and command-and-control indicators.

Article Details

Attack Vectors
  • Fake installers impersonating software including DeepSeek, Doubao, VPNs, trading platforms, and Chinese productivity and security applications deliver Gh0stRAT.
  • Installers are padded to exceed common automated sandbox file-size limits and use Inno Setup or, in an alternative chain, Advanced Installer.
  • The primary chain uses OLLVM obfuscation, a PNG-disguised encrypted payload, and sRDI to load Gh0stRAT into legitimate system processes.
  • The malware uses an ICMLuaUtil COM interface UAC bypass, service-based persistence, and a batch-file watchdog that restarts a malicious service.
  • An alternative chain uses DLL sideloading with a legitimate dropped executable to load Gh0stRAT.
  • Operators distribute payloads through newly registered spoofing domains, redirect hubs, and abused cloud or software-distribution services.
Defensive Notes
  • Monitor and block the malicious domains, IP addresses, and file hashes listed in the indicators.
  • Investigate unusually large software installers, including installers padded beyond typical sandbox file-size limits.
  • Inspect installers and installation behavior for hidden background execution, dropped companion DLLs or disguised data files, and unexpected service creation.
  • Monitor for ICMLuaUtil COM-interface abuse, reflective DLL injection into system processes, and suspicious DLL sideloading.
  • Detect batch-file watchdog loops that monitor processes and restart services, as well as unexpected executables launched as services from randomized C:\msys64 paths.
  • Assess suspicious traffic to redirect hubs and payload hosts, including infrastructure hosted on cloud services.

Indicators of compromise

TypeIndicatorContext
DOMAINabc[.]yu32k1[.]comCommand-and-control domain listed for the alternative Gh0stRAT variant.
DOMAINai-deepseekapp[.]com[.]cnSpoofing domain registered to lure users with a fake DeepSeek installer.
DOMAINdfgdhgg[.]s3[.]ap-east-1[.]amazonaws[.]comAWS S3 host identified as previously used by the actor for payload infrastructure.
DOMAINdoubaoaa[.]oss-cn-hongkong[.]aliyuncs[.]comAlibaba Cloud OSS host identified as previously used by the actor for payload infrastructure.
DOMAINdown[.]app-huorong[.]cnSpoofing domain used to distribute a payload masquerading as Huorong Security.
DOMAINlasjx[.]comGh0stRAT command-and-control domain listed for samples in the installer cluster.
DOMAINopencnwl[.]com[.]cnCentral hub identified as hosting payload delivery mechanisms reached through a malicious redirector.
DOMAINosnenfae[.]xyzMalicious redirector impersonating the OpenClaw AI agent and routing victims to a payload hub.
DOMAINpuppybob[.]xyzGh0stRAT command-and-control domain listed for an installer sample.
DOMAINwww[.]mq12ote0[.]comGh0stRAT command-and-control domain listed for a Doubao installer sample.
DOMAINwww[.]starx8[.]comGh0stRAT command-and-control domain listed for samples in the installer cluster.
DOMAINwww[.]uvsryx7i[.]comGh0stRAT command-and-control domain listed for samples in the installer cluster.
DOMAINwww[.]yamatofin[.]comGh0stRAT command-and-control domain listed for samples in the installer cluster.
EMAIL3799492994@qq[.]comEmail address used to identify the operator of the second malicious infrastructure cluster.
EMAIL7cf560423@baituo[.]ioEmail address used to identify the operator of the article's first malicious infrastructure cluster.
EMAILdaliandahouzi@gmail[.]comEmail address associated with the operator of the third malicious infrastructure cluster.
IPV4137[.]220[.]158[.]91Gh0stRAT command-and-control IP listed with port 8080.
IPV4154[.]23[.]184[.]235Gh0stRAT command-and-control IP listed with port 53.
IPV445[.]119[.]98[.]169Gh0stRAT command-and-control IP listed with port 45.
IPV447[.]238[.]68[.]204Gh0stRAT command-and-control IP listed with port 8080.
IPV447[.]239[.]173[.]17Alibaba Cloud IP used for Kraken Exchange spoofing lures.
IPV447[.]83[.]128[.]111Gh0stRAT command-and-control IP listed with port 22.
IPV48[.]210[.]120[.]164Alibaba Cloud IP used for Surfshark spoofing lures.
IPV48[.]210[.]196[.]194Alibaba Cloud IP used for Baidu Wangpan spoofing lures.
IPV48[.]210[.]220[.]5Gh0stRAT command-and-control IP listed with port 80.
SHA2560796130f37db020dc1f3619391c7c750fa4527b84ef2eb7a76c69c467ad80897SHA-256 of a malicious Inno Setup installer.
SHA25609daf847a00bc5c56ae18f7e5327eff3495981acdb0f663196b1ef2f5af6da72SHA-256 of an encrypted payload associated with Gh0stRAT.
SHA2560d44f92753f56ecb313c0271757f1212281d30f0a341a1e55329ce86f8573776SHA-256 of a Gh0stRAT payload DLL injected into the legitimate BrowserProtect process.
SHA256127c21f10abe1fccd90133b5ba8f83dc1b1de5580bb2dc71ea4329d64e2e7701SHA-256 of a malicious Gh0stRAT-associated DLL.
SHA25616f1591190994c0d38e184e57d0d9fca5f004e3eeb80934244c5472861c66692SHA-256 of a malicious installer.
SHA2561cca336c70e0cbf64bc0805cfc707c956a132ec2e43e24d34ff7126467d7fd2fSHA-256 of a malicious installer.
SHA25626e9bb278e2da8bf2ae68c9377bf4e4daef2c3bc460bc2067a0a327568b264b9SHA-256 of an encrypted payload associated with Gh0stRAT.
SHA2562dd624b7e0cef5980723fe9da6901ba9b02566624ade4002dbfdcb6cd85b442fSHA-256 of a malicious Gh0stRAT-associated DLL.
SHA2562f26cb96f34af9b98e2a360f017930957a9a8f759562562381b00679c21d07aeSHA-256 of a Gh0stRAT loader executable.
SHA2564e87f7cc3dc468b1ea3f9fb872ec3a15f8cef771c04c0465245d79422af2cc05SHA-256 of a malicious Gh0stRAT-associated DLL.
SHA25651385d63916a23480e38c1db5ec47608f31db3b3c7f1ebb0c5b207565b18a00fSHA-256 of a malicious Inno Setup installer.
SHA2565166ec466e894a89f69eaee10d04e20c96752f8ae622f01e935c8574697126d5SHA-256 of an encrypted payload associated with Gh0stRAT.
SHA25657f25d75f47ccdcb0a2be98d0fb4d081d9f7893880bf0050d6462c3f652bb2cbSHA-256 of a malicious Inno Setup installer.
SHA256595ad8fcecb1bd9e9ece57fbb8428ce031a7b3db06758a3add6432c8086bb1bbSHA-256 of a Gh0stRAT loader executable.
SHA256704ba3eb10f04f053f150e7eca60bb90931a7a0af80f571359424ad0929a4dbdSHA-256 of the alternative Gh0stRAT variant's main installer.
SHA256728c607aac876dafc1df4e487302698a1edfdfb1a01216aae04307306c88cd6eSHA-256 of an encrypted payload associated with Gh0stRAT.
SHA256735eae9d504285dd3d684dc3787af3a1ef83dbbc4200e60a579bb5ba830fa0d8SHA-256 of a malicious Gh0stRAT-associated DLL.
SHA2567b7c25e653ddba1f4aeb0f13ee091b90b2983de70bafc7f1bbb0b7a317a75296SHA-256 of a Gh0stRAT loader executable.
SHA2568b7d9ec5929f77617dd03cded74de742c98ea0788ebb5b3e2725c741bbb2581bSHA-256 of a malicious Inno Setup installer.
SHA2568fbab5008074cf93859c09f82b9214d5acc9e473f1bb04648dee1d83502a73b4SHA-256 of a malicious Gh0stRAT-associated DLL.
SHA256937f6a7e86733a2b8bacebb357fb3d14c960faf3f10bbfea5627c7735d6318b8SHA-256 of a Gh0stRAT loader executable.
SHA2569c7ab11b862f26ca4921c5ff7df3549c8a94dc9c52f170941dee5003d3e93545SHA-256 of a malicious Gh0stRAT-associated DLL.
SHA2569e2a3a468bdf99c3428bd31c29aba4c99e028ca6bdfe2e9f9657a27ff2c5f522SHA-256 of a malicious MetaTrader 4-themed installer.
SHA2569fd6e180cae4659dc5e5442a9c71ac979dc0f44179f55b3fd9d1b4846b62dba0SHA-256 of an encrypted payload associated with Gh0stRAT.
SHA256af257229403128b1a13dc6f45a674382b5faeca693a973c25b3a2d82e44b8260SHA-256 of a malicious MetaTrader 5-themed installer.
SHA256b4fd12c8ae54a7c1763d7894b24d4f3f43fde3b661a9cf8ba5c020e539c71cb1SHA-256 of a Gh0stRAT loader executable.
SHA256c726746595f7ef940ee201bfb9b977d53f404b768c88d44535058f4446da4eddSHA-256 of a malicious Gh0stRAT-associated DLL.
SHA256c99e8389923751bb1bd7d71ebef3125e41b9366fbae36d87dd723320629cf6a5SHA-256 of an encrypted payload associated with Gh0stRAT.
SHA256cbe0e7173f3c5265fffe79951f6e456df020fd0add02bb37cd622827e5824ae2SHA-256 of the alternative Gh0stRAT loader DLL.
SHA256d3db6d0f7062b00d4abbcb0471d3c11172389d0154ab977442404487d3746d74SHA-256 of a malicious Aicoin-themed installer.
SHA256d424ab3b2f639a7a9a06a623269e2ba8bd2957795031077f13a743dc189dda39SHA-256 of a Gh0stRAT loader executable.
SHA256d7f619f517f42cd09700080169b7a94b1f605fcad3101543ffc1d6fe278aa52aSHA-256 of an encrypted payload associated with Gh0stRAT.
SHA256dc98290d491b1a06e5b1e1c50cd70d99ba729545452185cb324c0db8ea6a28f1SHA-256 of a Gh0stRAT loader executable.
SHA256e3ecc8ee0856069bd9f804132a520b249212956f5e8975f805b15abf64632c69SHA-256 of a malicious Gh0stRAT-associated DLL.
SHA256eac7b98e6fbb50b9cf72910897433d500b0e2350561d2463db5014f559146f8dSHA-256 of a malicious Inno Setup installer.
SHA256f1c28e53fcf534c08dfc534ff147584cb0a2ed0bcfbae91591d005a1878f047bSHA-256 of a Gh0stRAT loader executable.
SHA256f35ad6e05981aeb7bbfa62837b3d6e35367ba856388e246a8cae8b51fe856f46SHA-256 of an encrypted payload associated with Gh0stRAT.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe article describes OLLVM obfuscation, encrypted payload data, and obfuscated batch-script contents.T1055 · Process InjectionThe payload injects Gh0stRAT into legitimate system processes, including sihost.exe, and injects a watchdog DLL into another process.T1056.001 · KeyloggingGh0stRAT uses SetWindowsHookExW and GetAsyncKeyState for keylogging.T1082 · System Information DiscoveryThe payload uses WMI queries in ROOT\CIMV2 for system enumeration.T1113 · Screen CaptureGh0stRAT uses GDI and GDI+ functions for screen capture.T1497.001 · System ChecksInstallers are padded to exceed public sandbox file-size limits and deter automated analysis.T1543.003 · Windows ServiceThe payload registers and launches an executable as a service, and its watchdog restarts a malicious service.T1548.002 · Bypass User Account ControlThe malware abuses the ICMLuaUtil elevated COM interface to bypass UAC and silently elevate privileges.T1574.002 · DLL Side-LoadingThe alternative infection chain sideloads a malicious DLL against a legitimate dropped executable.T1620 · Reflective Code LoadingThe sRDI-based shellcode loads the decrypted Gh0stRAT DLL into memory.

People

崔勇强Reported registrant name associated with the second operator cluster; the article gives the transliteration Cui Yongqiang.徐涛Reported registrant name associated with the first operator cluster; the article gives the transliteration Xu Tao.

Threat Actors

Silver FoxThreat group frequently associated with the malware delivery network; the article reports that law enforcement arrests targeted individuals connected to its operations.

Malware

Gh0stRATinfection chain identified in this campaign looks nearly identical. Victims receive a heavily modified Gh0stRAT variant hidden inside installers padded to over 100MB, which allows the malware to bypass file size

Vendors

Alibaba Grouprelease assets, Microsoft Store redirects, and enterprise cloud buckets across AWS, Google Cloud, and Alibaba.Amazon Web Servicespayloads hosted on GitHub release assets, Microsoft Store redirects, and enterprise cloud buckets across AWS, Google Cloud, and Alibaba.Googlehosted on GitHub release assets, Microsoft Store redirects, and enterprise cloud buckets across AWS, Google Cloud, and Alibaba.Microsoftwith abused legitimate services. We are currently tracking payloads hosted on GitHub release assets, Microsoft Store redirects, and enterprise cloud buckets across AWS, Google Cloud, and Alibaba.

Products

AICoinWhile the actor continues to target users seeking foreign access and trading platforms (ProtonVPN, NordVPN, MetaTrader 5, AICoin), they are increasingly spoofing domestic Chinese software.Baidu NetdiskEnterprise and Productivity: Lures include DingTalk (Alibaba’s enterprise communication platform), Baidu Netdisk, and Quark Browser.Baidu WangpanSurfshark lures resolve to 8[.]210[.]120[.]164, Kraken Exchange lures to 47[.]239[.]173[.]17, and Baidu Wangpan lures to 8[.]210[.]196[.]194.DeepSeekthey have capitalized heavily on the artificial intelligence boom by distributing fake installers for DeepSeek and Doubao. Regardless of the affiliate or the specific software being spoofed, the underlying infectionDingTalkEnterprise and Productivity: Lures include DingTalk (Alibaba’s enterprise communication platform), Baidu Netdisk, and Quark Browser.Doubaocapitalized heavily on the artificial intelligence boom by distributing fake installers for DeepSeek and Doubao. Regardless of the affiliate or the specific software being spoofed, the underlying infection chainHuorong SecuritySecurity Software: The actor is distributing payloads masquerading as Huorong Security (down.app-huorong[.]cn), a widely used Chinese antivirus and endpoint protection platform.KefuBaoLures exclusively target users of MetaTrader 4, MetaTrader 5, TradingView, AiCoin, and specialized enterprise customer service applications like WangshangLiao (旺商聊) and KefuBao (客服宝).Kraken Exchangeper spoofed brand campaign. For example, all recent Surfshark lures resolve to 8[.]210[.]120[.]164, Kraken Exchange lures to 47[.]239[.]173[.]17, and Baidu Wangpan lures to 8[.]210[.]196[.]194.MetaTrader 4Lures exclusively target users of MetaTrader 4, MetaTrader 5, TradingView, AiCoin, and specialized enterprise customer service applications like WangshangLiao (旺商聊) and KefuBao (客服宝).MetaTrader 5While the actor continues to target users seeking foreign access and trading platforms (ProtonVPN, NordVPN, MetaTrader 5, AICoin), they are increasingly spoofing domestic Chinese software.NordVPNWhile the actor continues to target users seeking foreign access and trading platforms (ProtonVPN, NordVPN, MetaTrader 5, AICoin), they are increasingly spoofing domestic Chinese software.ProtonVPNWhile the actor continues to target users seeking foreign access and trading platforms (ProtonVPN, NordVPN, MetaTrader 5, AICoin), they are increasingly spoofing domestic Chinese software.Qihoo 360NoLogWechat, NoLogTG). Additionally, the code checks for the presence of 360Hvm64.sys, a component of Qihoo 360 security software, indicating specific anti-analysis measures for Chinese operating systems.Quark BrowserEnterprise and Productivity: Lures include DingTalk (Alibaba’s enterprise communication platform), Baidu Netdisk, and Quark Browser.Surfsharkexactly one dedicated Alibaba Cloud HK IP address per spoofed brand campaign. For example, all recent Surfshark lures resolve to 8[.]210[.]120[.]164, Kraken Exchange lures to 47[.]239[.]173[.]17, and Baidu WangpanTradingViewLures exclusively target users of MetaTrader 4, MetaTrader 5, TradingView, AiCoin, and specialized enterprise customer service applications like WangshangLiao (旺商聊) and KefuBao (客服宝).WangshangLiaoLures exclusively target users of MetaTrader 4, MetaTrader 5, TradingView, AiCoin, and specialized enterprise customer service applications like WangshangLiao (旺商聊) and KefuBao (客服宝).

Tools

Advanced InstallerLike the primary variant, the initial installer is padded (~163MB); however, it utilizes an Advanced Installer package rather than Inno Setup. Execution relies on a DLL sideloading against a legitimate droppedhp-workerthe payload communicates with its command and control servers using a custom network stack built on the hp-worker library.Inno SetupInno Setup BundlessRDIsandboxes. The execution process involves OLLVM obfuscation, a UAC bypass, and Reflective DLL Injection (sRDI) to load the malware directly into legitimate system processes. Once active, the payload communicates withThemidaof the loader indicates it is heavily obfuscated utilizing OLLVM (Obfuscator-LLVM) and VMProtect/Themida-style protections to complicate control flow analysis. The loader’s primary function is to map aVMProtectCode analysis of the loader indicates it is heavily obfuscated utilizing OLLVM (Obfuscator-LLVM) and VMProtect/Themida-style protections to complicate control flow analysis. The loader’s primary function is to map a

Countries

China

Related Articles