Chinese Malware Delivery Domains Part II: Data Collection
Published on:
February 10, 2025
On This Page
Share:
This report dives deeper into activity relating to the previously reported cluster of Chinese Malware Delivery domains. Spoofed download websites of many common applications were observed collecting user information and delivering malware to Chinese speaking users.
Details
This report examines a second cluster of over 1100 domains suspected to have been registered by the same group between April 2024 to January 2025.
Cluster 1: The previously reported Chinese Malware Delivery domains appeared dedicated to malware delivery with minimal dynamic content or obfuscation employed. Primarily delivers Windows backdoors and info stealers. Minimal variability in HTML and JavaScript code.
Cluster 2: Suspected to be broadly focused on user data collection and selective malware delivery. Websites employ highly variable and obfuscated JavaScript files and multiple web analytic services. Purport to host binaries for Windows, macOS, iOS, and Android operating systems.
Spoofed Websites
Very similar to Cluster 1, Cluster 2 involves spoofs of many common applications from messenger apps, VPNs, cryptocurrency exchanges, gaming platforms, game emulators, online gambling, web browsers, and multimedia apps.
Below are screenshots of a sampling of the spoofed download websites over the past 60 days:
Domain Registration Details
The majority of the domains identified had common domain registration details:
wss dss wangyiyi wangyiyi caihua li yi yi wang wang yilu
The following heatmap shows the domain registration UTC timestamps for over 1000 domains from April 2024 to January 2025. The horizontal lines show the majority of the registrations occurred during the approximate working times 8 AM to 5 PM for China Time Zone and US East for comparison.
Domain registration times are not strong indicators of location as registrations can be done programmatically at any time. A heatmap of the registrations over time could be used to draw inferences on the normal operating times, volume and fluctuations of a threat group. One inference is that the actor commonly registers domains in bulk of 10 to 20 domains. Another is domain registrations continued steadily through recent US holidays of Thanksgiving, Christmas and New Years but made no new domain registrations from January 23 to February 8. The gap in domain registrations approximates to a week prior to and through Chinese New Year celebrations (January 29th - February 4th).
Based on a sampling of the 1200+ actor domains for domain registration costs, the cheapest registrations ranged from approximately $5 to $11 USD. Estimates based on these approximations suggest the actor may have spent over $6,000 in the past 10 months on domain registrations alone.
User Data Collection
Spoofed download websites were observed importing highly obfuscated JavaScript files. Their primary purpose appears to be to collect user data. Data is sent to one or more web analytic services. Primarily using Google Tag Manager (GTM), 51.LA and Baidu. A possible reason for using both a Chinese site analytics tracker and non-Chinese site analytic services is to improve data collection from users in and outside of China.
Typical data observed being collected:
Data collected include the following information about users in addition to setting cookies to potentially allow the tracking of users more long-term tracking across different websites.
IP addresses.
Browser type and version.
Operating system.
Screen resolution.
Referring website.
Pages visited and time spent on each page.
Geographic location (based on IP address).
Some websites were observed loading a js-sdk-recorder.min.js file and may attempt to screen record the browser session.
User browser data is collected and checks are performed to include looking for specific browser types and operating system.
The following are trackers extracted from the spoofed download sites and are suspected to be associated with the actor.
Creating thousands of websites and using SEO tactics could be aimed at increasing the site’s search ranking to appear higher in search results than legitimate sources. This can drive traffic to other malicious sites.
Fake Login Dashboards to Deliver Malware
The actor employs several websites themed as merchant backend management dashboards, payment services, crypto exchanges, email, and office applications. It is suspected that links to the fake login sites are distributed via phishing and similar means with the credentials shared to recipients. A mix of English and Chinese language use on the fake login websites and a common theme of merchant and payment backend management applications suggests the actor may be targeting English speaking individuals doing business in China.
The sites were observed hard coding the credential validation checks in the HTML login forms such as the following example seen from malicious domain: “otpaycn[.]com”.
Upon Logging into the fake Merchant Backend Dashboard, the following index page is loaded.
The only functional element is the Home Page at the top of the left panel. Clicking the Home Page loads an image in the center of the page that presents itself as a warning banner with a “Confirm” button. Clicking anywhere on the image initiates a download for a malicious dropper file that upon execution runs ValleyRAT on the system and downloads several modules from an Amazon S3 bucket providing additional functionality.
The image roughly translates to the following:
“VPN Usage Reminder Network connection failed, please use the dedicated network VPN It has been detected that your browser is missing the necessary VPN plug-in. Some functions cannot be used normally. Please update this function version first; if you choose to stop updating, you will not be able to use this function normally.What are the risks and how should I chooseConfirm.”
Notably, both clusters 1 and 2 were observed delivering identical Gh0stRAT and ValleyRAT binaries. Cluster 2 operates multiple varieties of spoofed website code, which often appear to utilize highly obfuscated JavaScript to collect user information and potentially selectively render functional malware delivery links. The majority of the websites were observed delivering 0-byte files, and less commonly copies of legitimate install files hosted locally on the site. A subset of the spoofed download sites were observed hosting identical Gh0stRat and ValleyRAT binaries as cluster 1 including “googleochrome[.]com” discussed in more depth later.
The 0-byte files are suspected to be placeholders, with real malware being delivered through obfuscated JavaScript dynamically loaded when certain user conditions are identified such as Geo IP location, language settings and browser type.
Earlier versions of the spoofed download sites appeared to typically host malware locally on the same spoofed website server. Later spoofed download sites began hosting files on other servers, commonly using other actor owned domains and often with subdomains “cnd.” or “down.”
More recent spoofed download sites continue to separate the spoofed websites from the hosted files by using Amazon’s CloudFront content delivery network such as the following:
Spoofed download sites for Lets VPN: “letscavpn[.]com” & “letsekvpn[.]com”
Using CDNs such as CloudFront as a delivery network can obscure the true origin location of the malware and make detection and mitigation efforts more difficult.
C2 Infrastructure
Identified multiple samples of suspected Gh0stRat backdoors being hosted from the spoofed download websites as having Command & Control (C2) to IP addresses. Multiple IP addresses shared the same server scan hash allowing a potential pivot to other IP addresses configured by the actor.
Malware delivery domain “googleochrome[.]com” spoofs as a Chrome browser download site and contains code to load content from a similarly named but different domain: “https[:]//down.googluchrome[.]com”
This initiates a file download for a file named “/Chrome.zip” with a SHA256 hash of “09efbe0c3e69c0f9a578bbbf0d475bd418497717921713779d1aa89dd2be35d6”
Chrome.zip unzips a file named “Chrome.msi” with a SHA256 hash of “e39e44cb79c5b1918d8139cfbb6d2ada044dbe4b413e86504f10e902072743fd”
Chrome.msi contains a file named “payload”, 522863520bcc368631a2db5016a1af68f60ecb074ddf19c9e7bff9834bb05248
The payload file upon execution calls out to the following IP:
TCP 154.91.90[.]102:4433
TCP 154.91.90[.]102:10443
At the time of observed use, the IP hosted a WinRM service with a Shodan.io hash of “%3A897366806”. 145 IPs shared this hash and nearly all are under Tcloudnet, Inc organization.
Triaging the IPs identified several have a recent history of malicious files communicating with them from similar variants.
A crucial aspect of this investigation lies in recognizing the broader implications of the observed tactics. History has repeatedly demonstrated that techniques initially deployed against one demographic or vertical are often adapted and repurposed to target others. While this campaign appears to currently focus on Chinese-speaking users, the sophisticated methods employed—including obfuscated JavaScript, strategic use of analytics services, and evolving infrastructure for malware delivery and data collection—represent a readily transferable playbook. Therefore, diligent monitoring and analysis of these tactics are not merely relevant to the current situation.
By proactively studying and understanding these techniques now, the cybersecurity community can better prepare for similar threats that may emerge, targeting different demographics and potentially posing a direct risk to a wider range of users in the future. This proactive approach is essential for developing effective defenses and mitigating the impact of future, related campaigns.
THE KNOWNSEC LEAK: Yet Another Leak of China’s Contractor-Driven Cyber-Espionage Ecosystem
Leaked Knownsec documents reveal China’s cyberespionage ecosystem. Analyze TargetDB, GhostX, and 404 Lab’s role in global reconnaissance and critical infrastructure targeting.
Learn More
Research
The APT35 Dump Episode 4: Leaking The Backstage Pass To An Iranian Intelligence Operation
APT35/Charming Kitten's leaked documents expose the financial machinery behind state-sponsored hacking. Learn how bureaucracy, crypto micro-payments, and administrative ledgers sustain Iranian cyber operations and link them to Moses Staff.
Learn More
Research
Chinese Malware Delivery Domains Part IV
Chinese Malware Delivery Domains Part IV uncovers 1,900+ new sites targeting Chinese-speaking users. Get a deep dive into infrastructure, TTPs, and AI-powered threat analysis.
