Date: 08/26/2026
Severity: High
Summary
A ValleyRAT campaign targeting organizations in India impersonates the Indian Income Tax Department through bilingual Hindi-English phishing emails and fake tax notices. Victims are directed to download a ZIP archive containing a legitimately signed Overwolf executable, which sideloads a malicious DLL and encrypted payload to deploy ValleyRAT. The campaign uses authentic tax provisions and government-style formatting to make the phishing lure appear credible.
Indicators of Compromise (IOC) List
Domains/Urls | dnfyb.vip https://dnfyb.vip/ http://taobaoker.vip/ https://taobaoker.vip/ https://kangyue.vip/ https://wayaya.vip/ https://cpxxw.vip/ https://usheng.vip/ http://wayaya.vip/ http://yakin.vip/ http://tanlianmeng.vip/ http://kangyue.vip/ http://nsseo.vip/ https://nsseo.vip/ https://dywwl.vip/ https://rpaai.vip/ https://kejiwei.vip/ http://cpxxw.vip/ http://usheng.vip/ http://dnfyb.vip/ http://dywwl.vip/ http://rpaai.vip/ http://kejiwei.vip/ http://shhswz.vip/ http://suoguan.vip/ http://zbrhcggp.vip/ |
IP Address | 103.240.196.115 |
Hash | 62e3ba37a23669139a222cd43ec2b202277a4030
f062e682ee38b33141ba03b17880b9cacca0e376
7de942da8993a45a5a7547de0a883f9b13f2f71c
061f3e304c65f3f062f2aacc41b6d6f8a4f43816
ab530af5603ce3f98b51b3c6f612074e020f572e
d03fb03e8969e7ecbd763aa4bdc67a4629e19b10
2d830905581ae5c29d1e6bad27c6b63a097f79d7
07846091fdeb1011cbd80d9ca45fd7dcb40b5c40
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "http://kejiwei.vip/" or url like "http://kejiwei.vip/" or siteurl like "http://kejiwei.vip/" or domainname like "https://kangyue.vip/" or url like "https://kangyue.vip/" or siteurl like "https://kangyue.vip/" or domainname like "https://nsseo.vip/" or url like "https://nsseo.vip/" or siteurl like "https://nsseo.vip/" or domainname like "http://taobaoker.vip/" or url like "http://taobaoker.vip/" or siteurl like "http://taobaoker.vip/" or domainname like "dnfyb.vip" or url like "dnfyb.vip" or siteurl like "dnfyb.vip" or domainname like "https://usheng.vip/" or url like "https://usheng.vip/" or siteurl like "https://usheng.vip/" or domainname like "http://dywwl.vip/" or url like "http://dywwl.vip/" or siteurl like "http://dywwl.vip/" or domainname like "http://shhswz.vip/" or url like "http://shhswz.vip/" or siteurl like "http://shhswz.vip/" or domainname like "http://wayaya.vip/" or url like "http://wayaya.vip/" or siteurl like "http://wayaya.vip/" or domainname like "https://taobaoker.vip/" or url like "https://taobaoker.vip/" or siteurl like "https://taobaoker.vip/" or domainname like "http://usheng.vip/" or url like "http://usheng.vip/" or siteurl like "http://usheng.vip/" or domainname like "https://kejiwei.vip/" or url like "https://kejiwei.vip/" or siteurl like "https://kejiwei.vip/" or domainname like "http://yakin.vip/" or url like "http://yakin.vip/" or siteurl like "http://yakin.vip/" or domainname like "https://dnfyb.vip/" or url like "https://dnfyb.vip/" or siteurl like "https://dnfyb.vip/" or domainname like "http://tanlianmeng.vip/" or url like "http://tanlianmeng.vip/" or siteurl like "http://tanlianmeng.vip/" or domainname like "https://cpxxw.vip/" or url like "https://cpxxw.vip/" or siteurl like "https://cpxxw.vip/" or domainname like "http://kangyue.vip/" or url like "http://kangyue.vip/" or siteurl like "http://kangyue.vip/" or domainname like "http://nsseo.vip/" or url like "http://nsseo.vip/" or siteurl like "http://nsseo.vip/" or domainname like "http://dnfyb.vip/" or url like "http://dnfyb.vip/" or siteurl like "http://dnfyb.vip/" or domainname like "http://suoguan.vip/" or url like "http://suoguan.vip/" or siteurl like "http://suoguan.vip/" or domainname like "http://cpxxw.vip/" or url like "http://cpxxw.vip/" or siteurl like "http://cpxxw.vip/" or domainname like "http://zbrhcggp.vip/" or url like "http://zbrhcggp.vip/" or siteurl like "http://zbrhcggp.vip/" or domainname like "https://wayaya.vip/" or url like "https://wayaya.vip/" or siteurl like "https://wayaya.vip/" or domainname like "https://dywwl.vip/" or url like "https://dywwl.vip/" or siteurl like "https://dywwl.vip/" or domainname like "http://rpaai.vip/" or url like "http://rpaai.vip/" or siteurl like "http://rpaai.vip/" or domainname like "https://rpaai.vip/" or url like "https://rpaai.vip/" or siteurl like "https://rpaai.vip/" |
Detection Query 2 : | dstipaddress IN ("103.240.196.115") or srcipaddress IN ("103.240.196.115") |
Detection Query 3 : | sha1hash IN ("7de942da8993a45a5a7547de0a883f9b13f2f71c","62e3ba37a23669139a222cd43ec2b202277a4030","f062e682ee38b33141ba03b17880b9cacca0e376","061f3e304c65f3f062f2aacc41b6d6f8a4f43816","ab530af5603ce3f98b51b3c6f612074e020f572e","d03fb03e8969e7ecbd763aa4bdc67a4629e19b10","2d830905581ae5c29d1e6bad27c6b63a097f79d7","07846091fdeb1011cbd80d9ca45fd7dcb40b5c40")
|
Reference:
https://www.forcepoint.com/blog/x-labs/valleyrat-overwolf-sideload-tax-scam