Overview

Qi'anxin Threat Intelligence Center and Skyrocket Falcon team found a group of unknown attackers are targeting blockchain customers during terminal operation, the malicious zip file is "transfer screenshot 2025.5.31.zip", the attackers spread it one-to-one through Telagram communication software, in the zip file are Lnk decoy, double-click to pop up the screenshot of the transfer record and release the White Plus Black component, memory loaded DcRat, C2 with a self-signed certificate mimicking qianxin.com.

Currently, ASRock's "Liuhe" advanced threat defense engine can block this Lnk, and we recommend customers to enable cloud checking function to find unknown threats.

Sample Analysis

The Lnk file points to the following commands:

Download the vbs script from the remote server and start it, the content is as follows, with Chinese comments, the content is very similar to the mainstream GPT auto-generated script code:

The decoy file is shown below:

The released black dll is digitally signed with a legitimate signature "Wuhoo Harmonious Reed Trade Co., Ltd."

The malicious code logic is in the Py_Main function, whose main function is to load a Shellcode in memory.

This Shellcode is a Loader which is used to load the final payload DCRat, C2: 103.45.68.150:80

After establishing a connection with C2, start Powershell to download the payload for the second stage:

The attacker pops up another decoy image in the second stage to show that the transfer is complete:

The function of the white-on-black component in the second stage is to read arphaCrashReport64.ini, decrypt it into Shellcode, and load it into the newly created process rundll32.exe.

The Shellcode function is the same as before, loading the same payload DCRat, C2: 38.46.13.170:8080

Expanding the Line

Its infrastructure used to build bitcoin selling websites, suspected to be used for fraud.

There are a small number of such sites active, and they seem to be built from the same templates:

Samples of the same origin were observed on VT, suspected to be propagated via SEO.

Also with a digital signature, currently logged off:

Sandbox recognized as AsyncRat, C2: 148.178.16.22:6666

Summarize

Currently, the full line of products based on the threat intelligence data from the Qi'anxin Threat Intelligence Center, including the Qi'anxin Threat Intelligence Platform (TIP), SkyRock, SkyEye Advanced Threat Detection System, Qi'anxin NGSOC, and Qi'anxin Situational Awareness, already support the accurate detection of such attacks.

IOC

FileHash-MD5：

05339834a0e7317505c74b58b19aaf0e

1b98984d2438d7a5d14b4f373b55603b

3cf9a8d8b7b68160d7523e60b0e43cd5

DcRat C2：

103.45.68.150:80|443

103.45.68.244:80|443

103.45.68.203:80|443

38.46.13.170:8080

AsyncRat C2：

148.178.16.22:6666

zl-web-images.oss-cn-shenzhen.aliyuncs.com