Silver Fox Wraps ValleyRAT in ZPAQ and a ByteDance Binary: A Telegram Chinese Language Pack MSI Lure

Summary

A rogue MSI installer posing as a Telegram Chinese language pack delivers a layered infection chain involving ValleyRAT, a BYOVD-based kernel rootkit, and a signed ByteDance executable abused for DLL sideloading. The installer also misuses the legitimate zpaqfranz archiving utility as a living-off-the-land binary and deploys the vulnerable wnBios driver to gain access to physical memory. Researchers linked the infrastructure behind the operation to CTG Server Ltd in Hong Kong and attributed the activity to the Silver Fox APT group. The campaign appears aimed at Chinese-speaking users in multiple countries across the Asia-Pacific region.

Investigation

Researchers reconstructed the full attack flow, starting with the MSI custom action and continuing through the extraction of ZPAQ archives, the selective use of the ByteDance SodaMusicLauncher binary for DLL sideloading, and the deployment of the wnBios kernel driver. Analysis of embedded configuration data exposed operator identifiers and command-and-control details. The supporting infrastructure was tied to bulletproof hosting previously associated with Silver Fox. Investigators also uncovered persistence techniques and antivirus-aware evasion logic used throughout the intrusion chain.

Mitigation

Prevent execution of the zpaqfranz binary outside approved backup or development environments and closely monitor MSI installations that rely on VBScript custom actions. Limit creation of the AppShellElevationService and detect unsigned DLLs placed alongside trusted signed binaries. Block outbound communication to the identified /21 network range operated by CTG Server Ltd and deny traffic over the custom C2 port 5040. Strengthen host-based protections against the malicious file names and process names observed in this campaign.

Response

Deploy detections for the identified files, spawned processes, and suspicious service creation events. Conduct hunts for the vulnerable kernel driver and the malware’s distinctive XOR-based decryption logic. Isolate potentially affected systems, collect memory images for deeper rootkit investigation, and reset any credentials exposed during the compromise. Threat intelligence teams should continue tracking CTG Server infrastructure for related follow-on activity.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  The threat actor receives a spear‑phishing link (T1566.002) that drops zpaqfranz.exe onto the victim workstation. The binary is a legitimate‑looking compression tool repurposed as a LOLBin (T1036). The attacker then launches it via PowerShell (T1059.001) with a hidden command line that instructs the tool to decompress a packed ValleyRAT payload (T1027) and execute it. The process runs under the current user context, generating a Windows process‑creation event that matches the rule’s Image|endswith 'zpaqfranz.exe' condition.

  Step‑by‑step:

  1. Stage the malicious binary in %TEMP%.
  2. Execute the binary with PowerShell, passing a dummy argument (-extract) to mimic the real payload.
  3. Maintain the process for a short period, then exit.

• Regression Test Script:

  # Silver Fox LOLBin Execution Simulation
  $tempPath = "$env:TEMPzpaqfranz.exe"
  
  # 1. Copy a benign executable to masquerade as the malicious LOLBin
  #    (In a real test you would drop the actual malicious binary.)
  Copy-Item -Path "$env:SystemRootSystem32calc.exe" -Destination $tempPath -Force
  
  # 2. Execute the LOLBin via PowerShell (simulating T1059.001)
  $args = "-extract C:Temppayload.bin"
  Write-Host "Launching $tempPath $args"
  Start-Process -FilePath $tempPath -ArgumentList $args -NoNewWindow
  
  # 3. Wait a few seconds to ensure the event is logged
  Start-Sleep -Seconds 5
  
  # 4. Optional: simulate cleanup (delete the dropped binary)
  Remove-Item -Path $tempPath -Force

• Cleanup Commands:

  # Remove any residual artefacts from the simulation
  $tempPath = "$env:TEMPzpaqfranz.exe"
  if (Test-Path $tempPath) { Remove-Item $tempPath -Force }
  
  # Terminate stray calc.exe processes that may have been launched inadvertently
  Get-Process -Name "calc" -ErrorAction SilentlyContinue | Stop-Process -Force