RATatouille: Today’s Special: Impersonating Companies in Korea, Payments in Cryptocurrency
- While tracking infrastructure related to ValleyRAT, numerous suspicious websites were identified that impersonated companies and brands from Korea such as Doosan Robotics and Cheonjeong.
- The identified sites used the actual companies’ logos, promotional videos, and descriptions to disguise themselves as official websites.
- The websites offered features such as invitation-code-based registration, login, fee history inquiries, VIP membership benefits, and cryptocurrency deposit and withdrawal functions.
- The online chat support provided instructions for USDT payments and TRON (cryptocurrency transfer network) wallet addresses, and users were also required to submit screenshots of their transactions.
- The address of the Doosan Robotics impersonation site is doosvnrobotics[.]Com, and the provided TRON wallet address is TCPahxMJQ944NBp6Ht2dwHk9EYEcoovP6W.
- Analysis of chumchuru[.]Com revealed a separate TRON wallet, TW5PcdoTMhyXniaA7tJntATAwfk6H3zq6H, where a total of five USDT deposits and three withdrawals were observed.
- All five deposits received by this wallet were sent from TQNdwQJV1T1ynBaHs8q6i9f7wZabpNpiMv, and the cumulative amount of USDT received by this wallet was confirmed to be approximately 13 million USDT.
- Infrastructure analysis began with the existing ValleyRAT C2-related IP address 14.128.53[.]155, And a total of 11 additional domains were identified based on past web observations and HTML titles.
- The identified domains included cycl.Top, chumchurum.Org, cyclx.Top, chumchuru.Com, chumchurum.Xyz, chumchurumc.Com, chumchurumcc.Com, chumchurumm.Xyz, chumchurumun.Cc, chumchurumun.Com, and doosvnrobotics.Com.
- Additionally, chumchurumum.Com was identified during a search based on ColorUi for UniApp (HTML Title related to web UI components), bringing the total number of potentially associated domains to 12.
- However, no direct operational link has been confirmed to date between the ValleyRAT malware operation and these websites or wallets, nor has it been proven that the funds originated from actual financial fraud.
chumchuru[.]com
chumchurum[.]org
chumchurum[.]xyz
chumchurumc[.]com
chumchurumcc[.]com
14[.]128[.]53[.]155
