{"id":2083,"date":"2025-02-19T10:03:42","date_gmt":"2025-02-19T10:03:42","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/02\/19\/weaponized-signal-line-and-gmail-apps-delivers-malware-that-changes-system-defenses\/"},"modified":"2025-02-19T10:03:42","modified_gmt":"2025-02-19T10:03:42","slug":"weaponized-signal-line-and-gmail-apps-delivers-malware-that-changes-system-defenses","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/02\/19\/weaponized-signal-line-and-gmail-apps-delivers-malware-that-changes-system-defenses\/","title":{"rendered":"Weaponized Signal, Line, and Gmail Apps Delivers Malware That Changes System Defenses"},"content":{"rendered":"

Weaponized Signal, Line, and Gmail Apps Delivers Malware That Changes System Defenses
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A sophisticated cyberattack campaign targeting Chinese-speaking users, malicious actors have weaponized fake versions of popular applications such as Signal, Line, and Gmail.<\/p>\n

These fake and weaponized apps are distributed via deceptive download pages that deliver malware capable of altering system defenses, evading detection, and exfiltrating sensitive data.<\/p>\n

The attackers exploit search engine manipulation to push fraudulent websites<\/a> that mimic legitimate software sources, luring unsuspecting users into downloading compromised executables.<\/p>\n

The malicious files are typically delivered in ZIP archives containing Windows executables. Upon execution, the malware follows a consistent pattern: extracting temporary files, injecting processes, modifying security settings, and establishing network communications.<\/p>\n

Researchers at Hunt.io noted<\/a> that the fake Signal download page at z1.xiaowu[.]pw<\/code> delivers a file named Sriguoei4.zip. Similarly, the spoofed Gmail page at ggyxx.wenxinzhineng[.]top<\/code> tricks users into downloading Goongeurut.zip, which installs a fake application called \u201cGmail Notifier Pro.\u201d<\/p>\n

\n
\"\"
Fake Gmail login page (Source \u2013 Hunt.io)<\/figcaption><\/figure>\n<\/div>\n

Execution and System Modification<\/strong><\/h2>\n

Once executed, the malware employs advanced techniques to manipulate system defenses.<\/p>\n

One notable example involves the use of PowerShell commands to disable Windows Defender<\/a> by excluding the entire C: drive from scanning.<\/p>\n

The command used is as follows:<\/p>\n

powershell -Command \"Add-MpPreference -ExclusionPath 'C:'\"<\/code><\/pre>\n
This effectively renders the system vulnerable to further exploitation. The malware also drops a secondary executable, such as svrnezcm.exe<\/em>, into deeply nested directories within the AppData folder:<\/p>\n
C:UsersuserAppDataRoaming41d8a4fa27e8d998445c22590e5b2cb4562svrnezcm.exe<\/code><\/pre>\n
This executable spawns additional processes and communicates with command-and-control (C2) servers hosted on Alibaba infrastructure in Hong Kong.<\/p>\n
For example, DNS queries to zhzcm.star1ine[.]com<\/code> and outbound TCP connections to 8.210.9[.]4<\/code> on port 45 suggest data exfiltration or remote control activities.<\/p>\n
\n
\"\"
Domain Overview (Source \u2013 Hunt.io)<\/figcaption><\/figure>\n<\/div>\n
The campaign relies on centralized infrastructure hosted at IP address 47.243.192[.]62<\/code>, which resolves to multiple malicious domains.<\/p>\n
The attackers also utilize Let\u2019s Encrypt TLS certificates to secure their spoofed websites<\/a>, adding a layer of credibility to their operations.<\/p>\n
\n
\"\"
Fake Signal Page (Source \u2013 Hunt.io)<\/figcaption><\/figure>\n<\/div>\n
This campaign shows the importance of verifying software sources and avoiding unofficial download sites.<\/p>\n
Users should remain vigilant against suspicious domains<\/a> and rely on trusted platforms for software installations to mitigate such threats effectively.<\/p>\n
Investigate Real-World Malicious Links & Phishing Attacks With\u00a0Threat Intelligence Lookup<\/strong>\u00a0-\u00a0Try for Free<\/a><\/code><\/strong><\/code><\/strong><\/p>\n
The post Weaponized Signal, Line, and Gmail Apps Delivers Malware That Changes System Defenses<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n
 \t

\n 
<\/BR>
\n    Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n 
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"
Weaponized Signal, Line, and Gmail Apps Delivers Malware That Changes System Defenses A sophisticated cyberattack campaign targeting Chinese-speaking users, malicious actors have weaponized fake versions of popular applications such as Signal, Line, and Gmail. These fake and weaponized apps are distributed via deceptive download pages that deliver malware capable of altering system defenses, evading detection, […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[63,258,649],"tags":[130],"class_list":["post-2083","post","type-post","status-publish","format-standard","hentry","category-cyber-security-news","category-malware","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/2083"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=2083"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/2083\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=2083"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=2083"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=2083"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}