someone is filing your GST return, and it is not your CA :: Himanshu Anand :: Security & Other Notes

someone is filing your GST return, and it is not your CA

2026-08-18 ::

Himanshu Anand

:: 10 min read (1930 words)

#malware

#threat-intel

#India

#reverse-engineering

#any.run

Table of Contents

Disclosure: this research was conducted using an ANY.RUN account provided as part of a collaboration. All analysis and conclusions are my own.

TLDR⌗

Found an unreported Silver Fox campaign serving ValleyRAT to Indian taxpayers with a fake “GSTR-3B overdue” lure, timed to the real 20 August GST filing deadline. The delivery is a disk image containing a genuinely Microsoft-signed SystemSettings.exe that sideloads a patched SystemSettings.dll (Microsoft cert still attached, hash broken cute). Stage 2 injects into RuntimeBroker.exe with a full UACMe kit, a Defender tamperer and an AV process-killer. Reversed both stages, recovered the full config: 3 C2 endpoints, a dormant backup domain, build date Aug 2 2026,and a 15 subdomain delivery platform that is serving per victim lure links as I type this.

how this started⌗

I was doing something completely different measuring how much India-targeted APT tooling even shows up in public sandbox feeds (spoiler: the APT36 stuff barely does, that is a whole separate post). While tag-hunting valleyrat on ANY.RUN’s public submissions, the feed was the usual suspects: fake VPN installers, something literally named jiazaiqitest.exe (加载器测试 “loader test”, they are not even trying), the usual Chinese-locale noise.

And then this, submitted 7 August 2026 :

GST_Filing_Overdue_GSTR-3B_GSTIN27ABCDE1234F1Z5_Due_20082026.zip

If you are not Indian: GSTR-3B is the monthly GST return every registered business files, GSTIN is the tax ID, and the 20th of the month is the actual deadline. The GSTIN in the filename even uses the correct format 27 is Maharashtra. Somebody on the operator side did the homework.

Sandbox verdict: Malicious . Tracker: Backdoor, RAT, ValleyRAT. Tags: silverfox, winos, processkiller.

Public coverage of this file, its C2s or a GST lure wave: zero . Nada, One lonely urlscan scan of the delivery domain.

the actor you already know⌗

Quick refresher, because context matters. Silver Fox (SwimSnake / Void Arachne / 银狐) is a China-nexus crew running ValleyRAT (built on the WinOS 4.0 framework plugin-based RAT, keylogger, screen capture, the works). The group has been targeting Indian users since at least December 2025 with Income Tax Department lures (nice work by CloudSEK on that one) and separately running SEO-poisoned fake software installers (NCC Group) and even a Russian false flag operation to muddy attribution. Their comfort food: DLL sideloading behind signed binaries, disposable free-domain C2, tax-season timing.

What nobody had reported: a GST wave, this infrastructure or this exact sideload pair. Until the ANY.RUN feed coughed it up.

unboxing the lure⌗

The ZIP contains a 1.2 MB .img disk image . Why a disk image? Because files inside a mounted image don’t inherit Mark-of-the-Web the “this came from the internet, are you sure?” prompts never fire. Double click and it mounts like a USB drive. Very 2024 technique still printing money in 2026.

Inside the image, two files:

GST_Filing_Overdue_GSTR-3B_..._Due_20082026.exe 98 KB<br>SystemSettings.dll 59 KB

And here is where it gets spicy.

Signature check:

EXE: VALID signature Microsoft Corporation<br>OriginalFilename: SystemSettings.exe (the real Windows Settings app, renamed)<br>DLL: Microsoft cert attached… but HashMismatch

The EXE is the actual, legit, Microsoft-signed SystemSettings.exe. The DLL was a real Microsoft binary until someone patched it. The signature is still there, it just no longer validates. To a reputation based filter, both files &ldquo;are Microsoft.&rdquo;

No unsigned attacker code ever touches disk. The whole stage-1 lives inside a tampered system DLL that a signed Microsoft process happily loads.

ghidra time: the dll that lies⌗

I opened the DLL in Ghidra DllMain? Stock CRT boilerplate Exports? Stubs If your static scanner keys on entry point weirdness, it sees nothing the implant is grafted into the CRT init path instead.

The fun starts in the orchestrator (FUN_180003030). This function never touches a readable string. Everything API names, C2, paths is built as stack constants , decoded in place, used, zeroed. With junk noop calls sprinkled between real instructions, because apparently my time is worthless.

The decoder is a single-byte XOR:

void decode(byte *buf, uint len) {<br>for (i = 0; i len; i++) buf[i] ^= 0x70;

First decoded block resolves kernel32.dll -> GetModuleHandleA. Standard &ldquo;resolve everything at runtime so the import table says nothing&rdquo; tradecraft:

And then my favorite screenshot of this entire analysis the C2, hiding in a movabs:

180003234 MOV RAX, 0x5e13080a14030919<br>180003246 MOV RAX,...