Chinese Malware Delivery Websites
Jan. 16, 2025, noon
Description
A cluster of over 400 domains have been registered since June 2024 to host spoofed websites delivering malware to Chinese-speaking users. The sites imitate popular applications like web browsers, VPNs, messaging apps, and crypto wallets. Identified malware includes Gh0stRAT, ValleyRAT, RemKos RAT, LummaStealer, and RedLine. The domains share registration details, infrastructure, and website configurations. Lures include fake login pages and software downloads. The activity shows similarities to the previously reported APT group SilverFox, suggesting an organized hack-for-hire or state-sponsored operation targeting Chinese speakers, possibly for credential theft and system access.
Tags
Date
- Created: Jan. 16, 2025, 11 a.m.
- Published: Jan. 16, 2025, 11 a.m.
- Modified: Jan. 16, 2025, noon
Indicators
- ffe3be504d0a89ace9271a6a1fc51f6b0539903a10b1bf89285875606852ba65
- fe86e1fff0afefd79de4fd26f041757495c5fadd116400699411a200978f0e41
- fe1b5431ae27c85b1c652e3ac9541c2a801540c02c04fa7f4a3a9543c284eca5
- f309c2c4847a5c888a580a2b154dfa1168016a9c3a335890f1b9e201819857e3
- e5205e1964b63ce14c85dd2c1ff6cdb06b3b1d323ccdbe0b2d6368a88dfe8f70
- e34fd0f5fbc5f09f55ccdf2e6a5f70215c8686f9c83c45f421ac2a475d8bfd47
- e15a6646d20b4aa486f06fa81a1af55be0bd99dbff85cbd7a7a29d15ad73a693
- e09056567f146da73aa0c4266a15cd61655e4402146b75a836d1c92926cd37c4
- d75a2b9d03aab50d9f3eb6afbde06034adec7a183dfcaf090ce78e4cd7a59117
- d219a6056e1f65507c984475711bd7e674b1319d11fd7a1149f3da983fd4f7c8
- d1c9957bd55933a619d22e741fadcee6085e679e66af5cd8edbff7d9cf8fd4cf
- ce34cc14e8d26119e1bf28a3a8368da6e10d13851004e2675976c5ad58b122e2
- c7531f022be3a5e33aa71aadcd5f0b5ae9989c7980b3a218e1e1415f6b61953d
- bfb90dfe0d6b4342489c4e8aa9c5ef803e462e0b451cb9ad016f2afba39fedf9
- bb152e75a72aa3ae675561f308614eba6c070e55e3895bc1b67125689dc24cee
- adb6afadbd9f31a2c6548b6e3c6378a7164a3604c04332e48a409c16faf4f598
- a099f02c95b99abfcb3825d795797a11d69a08dc0d95e9171325dc13a9bcd796
- 927474984e549f9d1269950e5782f755cb96f11d404a3cac56114d1e795609c5
- 86f8239224a0ace2b1e0a2216511b0a0aea1bf055f7cbeca2fcf9c316f3de921
- 839e314d6027977399ee486d1cadba972685550ab97467ec77ef746ffc81a478
- 7ac5b8905c760bf38d38761efc56362799f8a40b4fe2d570f56472b83a625360
- 7aa498dc87e734e306f850082fad723ca7c05ef2f0a84c5232111eb3e86156fc
- 73083665902ccc0cf7cbd48af24ecd62205ff2f0970e3206f6f9be5ae096bc46
- 65049df06de78a4fda14d5f07d83eef1b316c0dea0ecfc3dbec7e5e1b7b20754
- 5e1d7275b0abd484c15f186690db73c42e861311da3f5f048563636336933b4a
- 5283873308336ae1011ebfe1d057621413b7d528340e45d76359850d5589e662
- 443a4ce93232d56f0d1d15e6875f7eff5fc581f25df320e277608be0d1148fa1
- 29163c8afb477b27f700e1c5eac694a6cbb816a86c8eadbbbac6ba5c034a9c96
- 2901ca8eefd1d431d25f3d45dbf42dc48136b74692801ca0f6b606541d645baf
- 1f58903b39f58568589776333d2752957c1dd1a2c5296fd2fd5343560f6be860
- 005bdfdde6a0d0718ac60bcc7071bd87d0ac869308cf8dd7ed8afa7478709ba9
- 47.242.127.63
- 134.122.135.95
- http://quickqi.net/assets/download/quicqk66.12.msi
- http://quickiq.top/assets/download/win32-quicq.msi
- http://mctuqqe4z.top/qucke1.xn--2_-1e1dn6n.zip
- http://kuailianlow.com/download/letspn-latest.exe
- http://kuailiani.net/download/kuailian64.52.msi
- http://kipkshsa.top/download/letsvppn-latest.msi
- http://isdndjsq.top/assets/download/win32-quicq.msi
- http://134.122.135.95:4443
- villa.yiluying.com
- mumu.163i.top
- fs-im-kefu.7moor-fs1.com
- zoomi.fit
- ziniao.fit
- zhekou838.cn
- yuduba.xyz
- z42f1m.top
- yuanq.top
- yqdesk.top
- youdou.xyz
- youdoo.top
- youdoau.top
- youdaoz.top
- youdaox.top
- youdaoie.top
- yoodou.top
- yoodau.xyz
- yoodaou.xyz
- yoodau.top
- yoodaoi.club
- yoodao.fit
- yodaou.top
- yoadao.xyz
- yijfu.com
- yiijifu.com
- yiiji.xyz
- xzpay.work
- xxyy.work
- xmengapp.top
- xinzuan.top
- xinmeng.xyz
- xinlang.work
- xingzuan.xyz
- xingzuan.online
- xingzuan.fit
- xingzuan.club
- xingqiiu.club
- xiaohuojians.top
- ximmlang.club
- wymusic.top
- wymusic.fit
- wuyoujieee.com
- wudps.xyz
- wpszm.top
- wpsyz.top
- wpsxz.xyz
- wpsxi.club
- wpsxm.xyz
- wpssq.top
- wpss.xyz
- wpsrs.xyz
- wpsrc.work
- wpsrc.top
- wpsqx.top
- wpsqr.xyz
- wpsqm.com
- wpsma.top
- wpsla.site
- wpsiz.xyz
- wpsio.top
- wpsim.top
- wpsie.top
- wpsei.com
- wpsco.xyz
- wppsi.top
- wletsvpn.xyz
- wipses.fit
- winzips.work
- wiinrar.top
- winrarsz.top
- whtsaps.work
- whtsaps.fit
- whtsaps.vip
- whtsaps.club
- whtpps.work
- whtpps.club
- whtpps.fit
- whhapps.fit
- whhapps.club
- whatsacppy.club
- whapps.fit
- whapps.work
- whapps.club
- wangwangtalk.club
- wgoole.fit
- wangr.club
- vzvlco.top
- vltlpung.com
- vletsvpn.xyz
- visvpn.cyou
- vibers.work
- vibers.top
- vibers.site
- viber.cyou
- viberi.xyz
- vejm60.top
- viber.cc
- vb0ep.club
- utuncloud.world
- uq7djw.xyz
- uphot.net
- upcupe.xyz
- twyudoft.com
- uletsvpn.xyz
- ttcy365.com
- todeskzis.xyz
- tradingview.trade
- todeskze.top
- todeskeq.top
- todeskiz.club
- todeskei.xyz
- todeskc.top
- todesik.top
- todaski.club
- todaskek.xyz
- tletsvpn.xyz
- tittia.top
- tgsheng.top
- teleqpczm.club
- teleqercm.work
- teleqcrmn.fit
- teleqcrmn.club
- teleqcam.club
- telepwam.club
- teleprzm.fit
- telepqrm.work
- telepeqrm.fit
- telepcems.fit
- telepcem.club
- teleigpcm.vip
- teleigpcm.club
- telegrinxkam.top
- telegrpcm.xyz
- telegrimz.club
- telegrcm.ing
- telegramn.vip
- telegczem.club
- telegcvme.fit
- teleeqcrme.top
- teleepcrme.work
- teleagrmone.top
- teiegram.ing
- telagrmaxjsq.top
- teamviewers.club
- t0v0hlp.top
- taufp6.top
- subllmatxt.top
- surrl9oa.top
- szyyotmp.com
- steams.top
- sublitmext.xyz
- soulgou.club
- sougous.xyz
- sougous.top
- sougoo.site
- soogoo.icu
- soogou.store
- snipaste.top
- smsnet.top
- snapcheat.club
- smsactive.top
- sms-activation.club
- slqdgo.club
- skyes1.top
- signall.xyz
- signel.top
- shimoc.club
- shanghud.com
- shengfuton.com
- shandpey.world
- shandpay.top
- sandpray.top
- sandlpay.top
- sandipay.top
- sanderpay.top
- salesmart.top
- rtuoxxsr.com
- rggmo7j.club
- qwf123.cyou
- qwapmuuq.com
- quirkq.work
- quiirkq.club
- quiiqq.com
- quiickqz.top
- quiicka.xyz
- quickxq.xyz
- quickqzc.top
- quickqza.icu
- quickqi.top
- quickqi.net
- quickqgw.com
- quickqgw.net
- quickqgf.net
- quickq2.cc
- quickqgf.com
- quickq.fit
- quickiq.top
- quickq0101.cyou
- quicka.top
- quarki.top
- qqsgs.com
- qqis.work
- qqgj.online
- qmails.top
- qmail.work
- qeaick.buzz
- q0nmsl.fit
- pqqle.club
- pppicd.icu
- potatocn.xyz
- pht0j.cyou
- pgaab.icu
- paydocs8.com
- paopaom.online
- paga1io.top
- ouggle.fit
- oreyz.top
- oreyr.work
- orey.online
- orays.top
- orayi.world
- oracl.top
- opjs.club
- oolqow.top
- ooigle.xyz
- ooglze.fit
- ooglz.top
- ooglie.xyz
- ooglex.xyz
- oogles.top
- ooglex.top
- oogiie.top
- oogiew.work
- oogiel.top
- oogie.fit
- oogie.club
- oogglez.xyz
- oogglez.top
- ooggles.top
- ooggle.top
- ooggie.xyz
- ooggie.top
- oogchrm.club
- okyi.work
- oiggle.club
- ogglesr.top
- oggles.xyz
- oggle.xyz
- oggle.top
- oggle.club
- ogglchomr.top
- oggiechr.work
- oggie.top
- oggie.fit
- oggie.club
- officeim.club
- nsmnst.club
- nn3cotp.top
- nexchattc.cc
- mwai1.xyz
- modbydto.com
- miluvpn.com
- miitu.top
- mi163.top
- mexiko.cn
- messengerz.club
- messengers.work
- mesenger.club
- meiqias.xyz
- meipai.work
- me18qiyg.xyz
- mctuqqe4z.top
- mavishub.xyz
- m7neqzz.fit
- luoboo.online
- lttslian.xyz
- loubom.club
- lltslian.life
- llnes.world
- liine.work
- liine.fit
- liien.top
- lianlianpoy.com
- letwvpn.com
- letsvqr.xyz
- letsvqm.xyz
- letsvpn-ui.top
- letsrqn.top
- letsrpm.top
- letsqqp.club
- letsqpz.club
- letsqpw.club
- letsqpr.top
- letspw.top
- letspqw.fit
- letspcn.xyz
- letspqc.top
- letspcn.icu
- letspcm.top
- letskuail.icu
- letscqn.top
- letscdn.world
- letscgn.top
- letsbutr.com
- letrscp.fit
- lets-alyays-connect.com
- lediam.xyz
- lanlevp.top
- kwgiz1.club
- kuellien.xyz
- kualien.xyz
- kueliien.xyz
- kuaizip.top
- kuailxian.com
- kuailim.buzz
- kuailijen.xyz
- kuailiien.xyz
- kuailianz.com
- kuailiant.com
- kuailianlow.com
- kuailiani.net
- kuailian8.com
- kuailian0.com
- kuaiiyian.com
- kuaiilianoo.icu
- kuaiiam.fit
- kuai-lian.xyz
- klxiazopai.com
- kipkshsa.top
- kingtelmfng.top
- keuailian.top
- karlost.club
- karlosqp.xyz
- karlospt.top
- jiguang.icu
- kantu2345.club
- jdad7q.work
- j6ahar4i.top
- isdndjsq.top
- interhclp.com
- immersivetranslate.top
- imbken.club
- ilren.top
- iines.xyz
- iilne.top
- iilne.fit
- ibzeha.vip
- i4toos.life
- i4sp.top
- i4sapp.top
- i4sa.xyz
- i4b6.club
- i4app.top
- hvr3ez.work
- huurongs.top
- huoswe.top
- huorrong.xyz
- huoroug.top
- huorong.work
- huorong.site
- huorong.online
- huionepay.vip
- huifub.club
- hgb4hxl070.com
- helloworlids.top
- helloworldz.top
- helloworldw.top
- helloworldw.site
- helloworldcz.xyz
- hellowordz.top
- hellowordx.fit
- hellowordx.club
- heepayx.xyz
- gotonesn.top
- gotonesms.xyz
- goople.top
- googlre1.top
- googlez.top
- googleseso.top
- gmgmai.work
- gmgmai.club
- gmaib.top
- gckgmwc1.top
- g465cn.com
- g2ks0z.com
- fzqecfyi.com
- fsquhgne.com
- freetalk.online
- flashproxy.cc
- firefoxz.top
- fckjo9.club
- f3jb5x.top
- eyyz.top
- eyysm.com
- eyysi.top
- eyys.xyz
- eyyqp.top
- eyy5201.top
- eyy350.top
- eu0af6.club
- eniigme.club
- enigmar.fit
- eiyy.top
- ecprss.com
- dfapp188.world
- easytran.top
- dezscreener.work
- dexscreeners.icu
- dexscreener.fit
- deeplx.top
- deeplti.xyz
- deepll.xyz
- deepll.top
- deepli.top
- deepil.top
- cs-quickq.com
- crlg1wm.com
- cpgpay.site
- comprz.top
- cnacn3.top
- clashcn.xyz
- clashcn.top
- clashcn.club
- chromexn.com
- chrmpw.top
- chmole.club
- chme1.xyz
- chachap.top
- cgpay.vip
- btxueo.top
- btbrowserq.top
- browseri.vip
- bpss5vp.top
- bntbrowcer.xyz
- bmgsn6.top
- bitteroser.top
- bitpiez.club
- bitbrwwser.top
- bitbrwoser.top
- bitbrwoser.fit
- bitbrowszer.top
- bitbrowsri.top
- bitbrowsez.top
- bitbrowsers.work
- bitbrowseq.top
- bitbrowsec.top
- bitbrowcer.xyz
- baofuupay.com
- baofupay.top
- bananaguns.club
- bananagunn.cyou
- bananagun.fit
- baili888.club
- baidu-a.top
- baidu-a.cyou
- b-jlpay.top
- b-jipay.com
- avre.work
- avez.top
- anydeslk.top
- anydeskq.online
- anydeskcn.top
- anydesikq.top
- anydesik.top
- anydesik.com
- anydeisk.top
- andesksr.com
- aisbb.cyou
- adspowerr.top
- adober.club
- a1shung.club
- 70ka.club
- 6h4s3s.top
- 360z.fit
- 360browsap.top
- 2345ktws.xyz
- 2345kingtuwang.com
- 2345kantup.xyz
- 1o2mp.cyou
- 16cilz.xyz
- 163i.top
- 163e.top
- 1633.site
- 007z.top
Additional Informations
- Hong Kong
- China
- Malaysia