A signed “IEProc.exe” that delivers the APT-Q-27 backdoor in three stages

About this post: Thanks to MalwareHunterTeam for flagging this new payload. This analysis and write-up were produced by Claude (Opus 5.5), working as an agent in Claude Code on a REMnux analysis VM. Tools used: malcat, de4dotEx, ILSpy, dnlib, capa, Wine, gdb, ANY.RUN and Triage.

TL;DR

IEProc.exe is a small signed .NET program that downloads the rest of an attack kit from Google Cloud Storage. That kit hides inside a genuine Tencent game component and ends in Golden Gh0st RAT, a backdoor built on the Gh0st RAT source code, which was published in 2008 and has been reused in attacks ever since. Expel named and documented Golden Gh0st RAT in July 2026. They attribute it to CylindricalCanine, a subgroup of the Chinese cybercrime group GoldenEyeDog (also tracked by Qi’anxin as APT-Q-27). The group has been running dropper "waves" like this one for months, and this wave reuses files and keys we have seen before, byte for byte.

• Signed: stage 1, the game component and the protected loader DLL are all signed with the same Certum Extended Validation (EV) certificate, issued to Hangzhou Yueque Li Technology Co., Ltd. (serial 05923499141496b67bb7b4687809454b). All three were signed on 29 October 2026, within about four and a half hours.
• Delivery: VirusTotal also lists the file as Image202610305689.scr, a program posing as a picture. A recovered email from the same campaign shows how this works: a fake customer sends a support desk a "screenshot" of an error page.
• Sandbox-shy: it checks for Windows Sandbox and Google Cloud machines. Stage 2 only fully runs from the exact folder that stage 1 created.
• The payload: a remote-control backdoor with screen capture, keylogging, a remote shell, file access and a proxy. It talks to app.probref[.]com on port 5188.
• Same family, proven: the plugin file is identical to one from earlier waves, and the C2 traffic decrypts with the family’s known key.

"But it’s signed!"

Code signing is a digital signature on a program. It tells Windows who published the file and that nobody changed it afterwards. An EV certificate is the premium tier: the company has to pass extra identity checks before the certificate authority issues it.

The certificate here was issued to Hangzhou Yueque Li Technology Co., Ltd. on 13 August 2026. The sample was signed with it on 29 October 2026. A brand-new certificate that is immediately used to sign someone else’s product is a pattern we see again and again with signed malware. The certificate has been reported to Certum and added to the CertGraveyard.

Disguised as a picture

On VirusTotal, this same file also appears under the name Image202610305689.scr. A .scr file is a Windows screensaver, and a screensaver is just a program with a different extension. Double-click it and it runs like any .exe. A name like "Image" plus a date makes it look like a photo someone sent you.

This group has used the same trick before, with names like photo20260528899.com and image2026060356.com. Expel reports that the group mainly sends its malware in phishing emails and through submissions to support portals. We recovered one of those emails, sent to a company’s support address in July 2026. It belongs to the same campaign, three months before this sample, and shows how the lure works.

The email plays a frustrated new customer who "can’t register an account". The message is two short lines and an embedded "screenshot" of the error they keep getting. The screenshot is tiny (185 × 61 pixels) and blurry, just readable enough to make out "503 Service Temporarily Unavailable". That is the point: the natural thing for a support agent to do is click it to see the full picture. The picture is a link to myphotos.s[.]gy/photo20260729.png, a file hosting address, not an image attached to the email. We did not visit that link. Earlier waves were delivered as files named like photo….com, so it most likely led to a download of the same kind.

A few details stand out:

• A free Gmail account with a made-up name sends it. The email passes SPF, DKIM and DMARC because it really did come from Gmail. Those checks prove where an email came from, not that the sender is honest.
• The sender’s clock is set to UTC+8, the time zone of China. It shows in the email’s date header.
• The decoy closes the loop. The kit’s image.jpg decoy is a picture of the very same "503 Service Temporarily Unavailable" page. When the agent opens the "screenshot", they see exactly the error the customer described, while the malware installs itself in the background.

Support desks are a good target. Their job is to open messages from strangers and look at the attachments, and their machines often have access to customer systems.

Stage 1: a downloader inside a virtual machine

Open IEProc.exe in a .NET decompiler and you mostly see methods that hand a number to one big interpreter. That is a code virtualizer: the real instructions are translated into a private bytecode that only the program’s built-in "virtual machine" understands. Think of a letter written in a cipher that only the sender’s own decoder ring can read.

This isn’t special to this group. Code virtualization is a standard feature of commercial .NET obfuscators. Legitimate software vendors use it to protect their code, and plenty of unrelated malware does too. This one looks like a stock commercial product, most likely Eazfuscator.NET. The group’s earlier downloaders came with a different protector or none at all, so the obfuscator says nothing about who is behind a sample.

Rather than rebuilding the cipher, we put a listener on the decoder ring. Every time the virtual machine calls into normal Windows or .NET code, it goes through one single method. We patched that method (with dnlib) to log what it was about to call and with which arguments. Then we ran the patched copy in an isolated Wine sandbox with a fake web server. The result was a complete step-by-step trace of what stage 1 does.

Am I being watched?

Before downloading anything, stage 1 looks around. It quits if the user account is WDAGUtilityAccount (the account Windows Sandbox uses), or if the network is mshome.net. It also quits if it finds Google Cloud drivers (gv3.sys, gcbd.sys, gce_bridge.sys), Google Cloud environment variables, or the word "google" in system information or process names.

Many automated malware sandboxes run on cloud machines, so this is a cheap way to stay invisible to some of them. These checks aren’t new: a downloader from one of this group’s June 2026 waves ran almost the same list.

Downloading the kit

If the coast is clear, stage 1 builds a hidden folder:

%LOCALAPPDATA%\Microsoft\IEProc\Update\temp_<date>_<4 hex>@2026\

It then fetches a file list from storage.googleapis[.]com/ieproc/IE.txt (base64, encoded twice) and downloads every file on it, five at a time, with three retries each. It is all or nothing: if even one file fails, nothing is started. On the day we looked, the list held four files:

• IEProc.exe, a second program with the same name (stage 2)
• IE.AV, a 19.6 MB protected DLL
• IEProc.dat, an encrypted container
• image.jpg, a decoy picture that opens on screen while the rest runs hidden

Stage 1 itself sets no persistence. It runs once, launches the kit and exits.

Stage 2: hiding inside a real game component

The second IEProc.exe is a genuine Tencent "QQ Games" Internet Explorer component, re-signed with the same Hangzhou Yueque Li certificate. Like many programs, it loads a helper DLL (IE.AV) from its own folder. Planting a malicious DLL next to a trusted program so the program loads it is called DLL sideloading. To security tools, it looks like a legitimate, signed app is running.

IE.AV is heavily protected. It does four things:

• It decrypts IEProc.dat (a container whose header reads "DISTLOAD1") straight into memory. The Golden Gh0st RAT core never touches the disk in readable form.
• It adds a Run key, HKCU\Software\Microsoft\Windows\CurrentVersion\Run\IEProcUpdat, so the kit restarts at every logon.
• It copies the whole kit into %USERPROFILE%\Music\<8 hex>@2026\ and writes a small marker file, %ProgramData%\tor.dat.
• It drops oihtq.uqv, an encrypted plugin file.

The folder is the key

In our first local run, stage 2 decrypted the core and set the Run key, then simply stopped. There was no copy and no network traffic. We then placed the kit in the exact folder stage 1 uses (…\IEProc\Update\temp_<date>_<hex>@2026\) and changed nothing else. This time the full chain ran, and the backdoor started knocking on our fake C2 server every 11 seconds.

So the loader checks where it is running from. If you copy the files to a different folder, as an analyst or a sandbox often does, you only see part of the story. We have seen the same family use a filename check in an earlier wave.

How we know it’s APT-Q-27

Family names are easy to guess and hard to prove, so we only link samples on exact matches. This wave has several:

• Identical plugin: oihtq.uqv, decrypted with the family’s known plugin key, is plugin32.dll with SHA256 813c4a2a…. That is byte-for-byte the same file as in the "nikeupdat" wave from July and August 2026.
• Same C2 key: the backdoor’s first message to its server (the "register" message, with the PC’s OS version, IP address, MAC address and hostname) decrypts with the exact key we recovered from an earlier wave. It worked on the ANY.RUN traffic and on the traffic our own sandbox captured. A random key or a key with one flipped bit does not.
• Same legacy C2 string: the decrypted core still carries e.nkking[.]com, the server name from a 2025 sample of this family.
• Same decoy: image.jpg has the same hash as the decoy in three earlier waves.

ANY.RUN also tagged its run apt-q-27. That tag comes from a network rule, so it adds little on top of the C2 key match.

What the backdoor can do

The Golden Gh0st RAT core first fingerprints the machine: Windows version, disks, memory, CPU and drives. It also checks for antivirus products, mostly popular Chinese ones (360, QQ PC Manager, Kingsoft, Baidu) plus Microsoft Defender and McAfee.

The core contains targets for Chrome, Firefox, 360 browsers, QQBrowser and Sogou, and for Skype, Telegram and WhatsApp. The plugin adds the hands-on tools: screen capture, keylogging, a remote shell, file management, opening URLs and a SOCKS proxy. A SOCKS proxy lets the attacker route their own traffic through your PC.

In the ANY.RUN run, the server at app.probref[.]com (13.231.249[.]106) accepted the registration and replied with a keepalive. It sent no commands during the session.

What the local analysis couldn’t reach

• Where the C2 name comes from: in memory, app.probref[.]com only appears after the backdoor has decoded it. We did not find the encrypted source.
• The exact folder check: we know the folder matters, but not which part of it (the @2026 suffix, the parent path or the name).
• The tor.dat marker: it encodes a timestamp. We did not reverse the encoding.
• What came next: the server sent no commands, so any follow-up payloads remain unseen.
• The delivery email for this exact file: the email shown above is from the same campaign but three months earlier. We haven’t seen the message that carried Image202610305689.scr, and we didn’t visit the email’s link to confirm what it served.

What should you do?

If you’re a regular user: a picture never needs to be "run". Be suspicious of any "image" whose file name ends in .scr, .com, .pif or .exe, and turn on file-name extensions in File Explorer so you can see them. More generally, don’t run programs you received unexpectedly, even if Windows shows a verified publisher. A valid signature only tells you who signed the file, not whether it is safe. If you find an IEProcUpdat entry in your startup programs, or folders ending in @2026 under Music or AppData\Local\Microsoft\IEProc, treat the machine as compromised.

If you defend a network:

• Block or quarantine executable attachments disguised as images (.scr, .com, .pif) in email and on support-ticket portals. Support desks are a known target of this group.
• Block or alert on app.probref[.]com and 13.231.249[.]106, and on WebSocket handshakes with the odd path GET /\.
• Hunt for \Microsoft\IEProc\Update\temp_*@2026\ and \Music\*@2026\ folders and the IEProcUpdat Run value.
• Watch for storage.googleapis[.]com/ieproc/ downloads. This group rotates bucket names per wave, so also look for small, signed programs pulling .txt lists from new buckets.
• Run sandboxes with realistic file paths and non-cloud fingerprints. This kit hides from both "wrong folder" and "Google Cloud" environments.

IOCs

ANY.RUN analysis: 713c7c42-40d6-4b0b-bce2-96ff8627308d

Wrapping up

APT-Q-27 keeps the same building blocks from wave to wave: a signed sideload host, an encrypted core, a plugin file and a WebSocket C2 with a fixed key. What changes is the wrapper. This time it is a freshly issued EV certificate, a .NET downloader wrapped in an off-the-shelf obfuscator, and a loader that only fully runs from the folder it expects.

The reused pieces are what give the group away. One identical plugin file and one working decryption key were enough to tie this sample to the earlier waves. If you have seen other samples signed by Hangzhou Yueque Li Technology, or other storage.googleapis[.]com buckets with an IE.txt list, we’d like to hear about them.