DragonDoll: a matryoshka in the world of Android spies 🪆 At the beginning of this spring,…
“Tax Audit” from East Asia 🚪
At the beginning of the investigation, the PT ESC Threat Intelligence team discovered attacks on several Russian banks. All observed messages were sent from the domain onmbv.com, for example: TAX@notifications.onmbv.com, TAX@news.onmbv.com
The domain onmbv.com itself was registered on 2025-09-14. If you visit the website, ONMBV positions itself as scalable infrastructure with modern technologies. However, the site itself looks like a phishing stub with non-functional features, aside from the most basic display with a typical interface (screenshot 1).
The malicious emails contained notifications about a tax audit purportedly from the Federal Tax Service (FNS) and urged users to download a “package of documents” attached to the message (screenshot 2).
The archives contained several DLL files, .exe and .png. For example, the file -ФНС России.zip (SHA-256: 81e64f5c5b06dd415e4fd60defac5f1573d5c9d83094181bf359f9e5af8765da) contained the files from screenshot 3.
👀 Three files are of particular interest:
• Проверьте этот файл.exe — 2b6679179a67b3c4b24e4708802a15b3bd3655a60aa0de4ce5b39b6814ec31d1
• QQMusicCommon.dll — 9a037129dd9fd9f2f776c7d996b82dac76042ae0f69c765522ff2f0904d726da
• 9LmcIWuG.png — dc7b25b00804ca264648ea5e280bfec4d818495ad24daa11daa6069a0621d317
The .exe file itself is a clean .exe with a PDF icon as a decoy.
On VirusTotal it was uploaded under various names, mostly from Russia:
• Документ.exe
• Откройте и ознакомьтесь с файлом.ex_
• 坏抉抗批技快扶找.exe (Simplified Chinese)
It was also uploaded from Taiwan under the names Namelist.exe and Откройте.exe.
When the .exe is launched, the DLL-sideloading technique loads QQMusicCommon.dll, which masquerades as a component of the popular Chinese music application and service QQ Music. The library itself is obfuscated using Control-Flow Flattening.
The malicious DLL is a dropper that reads and decrypts the payload from the file 9LmcIWuG.png and executes it.
In all cases we discovered, the payload was ValleyRAT, associated with Chinese cybercriminal activity. In our case, the C2 was the IP address 207.56.138.28 from Hong Kong.
🐀 ValleyRAT is a RAT (Remote Access Trojan) type of malware written in C++. It allows hackers to secretly control an infected computer, monitor the screen, steal data, and download additional modules. Some sources call ValleyRAT a variant of the old Gh0st RAT, but it is a separate piece of software with similar functionality. It was first spotted in early 2023 and spreads through phishing and fake installers of popular programs.
During further study, we saw that in addition to the “ФНС” samples, we have many “CBDT” archives, for example “CBDT.zip“. In our case, CBDT — Central Board of Direct Taxes, the Indian equivalent of the FNS.
Although some of the files targeting India used the same C2, during our investigation of archives related to the attacks on India, we discovered an additional C2 that was used predominantly in those attacks — 108.187.37.85. The files associated with this C2 used the same kill chain: .exe, DLL-sideloading, and “images” with ValleyRAT.
Besides India, some files were uploaded from Nepal and Indonesia, but most were still from India. The attacks on Indian companies began earlier than those on Russian ones — in early December. At the time of the attacks, the C2 108.187.37.85 was also located in Hong Kong, but the ASN has since changed (the server is no longer located in Hong Kong).
Given the TTPs used by the software, as well as the likely phishing resource, we assume that the attack may be attributed to the East Asian financially motivated Silver Fox group 🦊
IP
