malware

Chinoxy S1041

Type: malware
Platform: Windows
Created: 21 September 2022
Last modified: 11 April 2024

Chinoxy is a backdoor that has been used since at least November 2018, during the FunnyDream campaign, to gain persistence and drop additional payloads. According to security researchers, Chinoxy has been used by Chinese-speaking threat actors.[1]

TechniquesBottom 23%

Tactics32nd pct

Threat groupsNone recorded

Campaignunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S1041

Reach is how much of ATT&CK this malware touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects the execution of DLL side-loading malware used by threat group Emissary Panda aka APT27	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL	-	critical	Florian Roth (Nextron Systems)	2018-09-03	2023-03-09	9aa01d62-7667-4d3b-acb8-8cb5103e2014
	Detects potential DLL sideloading activity via the Aruba Networks Virtual Intranet Access "arubanets (...)	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-01-22	2023-03-15	90ae0469-0cee-4509-b67f-e5efcef040f7
Splunk	The following analytic detects the execution of tools commonly exploited by cybercriminals, such as those used for unauthorized access, network scanning, privilege escalation, password dumping or data exfiltration. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike · Cisco NVM · Cisco	Reconnaissance Active Scanning Stealth Masquerading Match Legitimate Resource Name or Location Credential Access OS Credential Dumping	-	medium	Bhavin Patel, Splunk, sventec, Github Community	2021-07-12	2026-09-22	a51bfe1a-94f0-48cc-b4e4-16a110145893	-
	Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Stealth Deobfuscate/Decode Files or Information Stealth Obfuscated Files or Information	-	high	Florian Roth (Nextron Systems)	2020-01-29	2023-01-26	e32d4572-9826-4738-b651-95fa63747e8a
Splunk	The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Stealth Deobfuscate/Decode Files or Information	-	medium	Michael Haag, Splunk	2021-03-25	2026-10-02	bfe94226-8c10-11eb-a4b3-acde48001122
	Detects modification of Windows Registry Classes keys used for persistence. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-10-22	9df5f547-c86a-433e-b533-f2794357e242
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split), wagga (name)	2019-10-25	2025-10-22	f59c3faf-50f3-464b-9f4c-1b67ab512d99
	Detects creation of specific system DLL files that are usually not present on the system (or at least not in system directories) but may be loaded by legitimate processes. (...)	Generic	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	CVE-2020-7315	medium	Nasreddine Bencherchali (Nextron Systems), fornotes	2022-12-01	2026-01-24	df6ecb8b-7822-4f4b-b412-08f524b4576c
	Detects deployments of pods within the kube-system namespace, which could be intended to imitate system pods. (...)	Generic	test	-	-	Kubernetes Audit · Kubernetes	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Leo Tsaousis (@laripping)	2024-03-26	—	a80d927d-ac6e-443f-a867-e8d6e3897318
	Detects the creation of a file named "WerFault.exe" or "wer.dll" in an uncommon folder, which could be a sign of WerFault DLL hijacking.	Generic	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	medium	frack113	2022-05-09	2026-05-18	28a452f3-786c-4fd8-b8f2-bddbe9d616d1
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2023-08-17	f674e36a-4b91-431e-8aef-f8a96c2aca35
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-10-22	20f0ee37-5942-4e45-b7d5-c5b5db9df5cd
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2025-10-22	cbf93e5d-ca6c-4722-8bea-e9119007c248
	Detects the installation of a Callout DLL via CalloutDlls and CalloutEnabled parameter in Registry, (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL Persistence, Defense Impairment Modify Registry	-	high	Dimitrios Slamaris	2017-05-15	2023-08-17	9d3436ef-9476-4c43-acca-90ce06bdf33a
	This rule detects a DHCP server error in which a specified Callout DLL (in registry) could not be lo (...)	Generic	test	-	windows	WinEventLog System	Execution, Stealth Hijack Execution Flow DLL	-	high	Dimitrios Slamaris, @atc_project (fix)	2017-05-15	2022-12-25	75edd3fd-7146-48e5-9848-3013d7f0282c
	This rule detects a DHCP server in which a specified Callout DLL (in registry) was loaded	Generic	test	-	windows	WinEventLog System	Execution, Stealth Hijack Execution Flow DLL	-	high	Dimitrios Slamaris	2017-05-15	2022-12-25	13fc89a9-971e-4ca6-b9dc-aa53a445bf40
	Detects DLL sideloading activity seen used by Diamond Sleet APT	Emerging	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	CVE-2023-42793	high	Nasreddine Bencherchali (Nextron Systems)	2023-10-24	—	d1b65d98-37d7-4ff6-b139-2d87c1af3042
	Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, oscd.community, Swachchhanda Shrawan Poudel (Nextron Systems)	2019-10-25	2026-01-05	24357373-078f-44ed-9ac4-6d334a668a11
	Hunts known SVR-specific DLL names.	Emerging	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	medium	CISA	2023-12-18	—	e64c8ef3-9f98-40c8-b71e-96110991cb4c
	Detects when an attacker create a similar folder structure to windows system folders such as (Window (...)	Generic	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	frack113, Nasreddine Bencherchali (Nextron Systems)	2022-07-30	—	b6f91281-20aa-446a-b986-38a92813a18f
	Detects execution of VMware Xfer utility (VMwareXferlogs.exe) from the non-default directory which m (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution, Stealth Hijack Execution Flow DLL	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-08-02	—	ebea773c-a8f1-42ad-a856-00cb221966e8
	Detects processes loading the non-existent DLL "ShellChromeAPI". (...)	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-12-01	—	ee4c5d06-3abc-48cc-8885-77f1c20f4451
	Detects a DNS server error in which a specified plugin DLL (in registry) could not be loaded	Generic	test	-	windows	DNS Server	Execution, Stealth Hijack Execution Flow DLL	-	high	Florian Roth (Nextron Systems)	2017-05-08	2023-02-05	cbe51394-cd93-4473-b555-edf0144952d9
	Detects when a user enables DNS-over-HTTPS. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Stealth Deobfuscate/Decode Files or Information Persistence, Defense Impairment Modify Registry	-	medium	Austin Songer	2021-07-22	2023-08-17	04b45a8a-d11d-49e4-9acc-4a1b524407a5
	Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641	Emerging	stable	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location	CVE-2015-1641	critical	Florian Roth (Nextron Systems)	2018-02-22	2021-11-27	7993792c-5ce2-4475-a3db-a3a5539827ef
	The Fax service attempts to load ualapi.dll, which is non-existent. (...)	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	NVISO	2020-05-04	2022-06-02	828af599-4c53-4ed2-ba4a-a9f835c434ea
	Detects msdt.exe creating files in suspicious directories which could be a sign of exploitation of e (...)	Generic	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	CVE-2022-30190	high	Vadim Varganov, Florian Roth (Nextron Systems)	2022-08-24	2023-02-23	318557a5-150c-4c8d-b70e-a9910e199857
	Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (...)	Generic	test	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Nasreddine Bencherchali (Nextron Systems)	2024-06-24	—	13c02350-4177-4e45-ac17-cf7ca628ff5e
	Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.). (...)	Generic	test	file_event	windows	Sysmon	Stealth Masquerading Match Legitimate Resource Name or Location	-	medium	Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)	2020-05-26	2026-07-28	d5866ddf-ce8f-4aea-b28e-d96485a20d3d
	Detects a flashplayer update from an unofficial location	Generic	test	proxy	-	-	Initial Access Drive-by Compromise Stealth Masquerading Match Legitimate Resource Name or Location Execution User Execution Malicious File	-	high	Florian Roth (Nextron Systems)	2017-10-25	2022-08-08	4922a5dd-6743-4fc2-8e81-144374280997
	Detects the setting of a custom protocol handler with the name "rogue". (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	CVE-2022-38028	high	Nasreddine Bencherchali (Nextron Systems)	2024-04-23	—	5cdeb555-65de-4767-99fe-e26807465148
	Detects the setting of the DLL that handles the custom protocol handler. (...)	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	CVE-2022-38028	high	Nasreddine Bencherchali (Nextron Systems)	2024-04-23	—	d807056b-0e00-4cec-b7f8-b8b7518e382b
	Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Syma (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter PowerShell Command and Control Ingress Tool Transfer Stealth Masquerading Match Legitimate Resource Name or Location	-	critical	Florian Roth (Nextron Systems)	2020-05-20	2023-03-09	3711eee4-a808-4849-8a14-faf733da3612
	Powerup tool's Write Hijack DLL exploits DLL hijacking for privilege escalation. (...)	Generic	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Subhash Popuri (@pbssubhash)	2021-08-21	2024-06-27	602a1f13-c640-4d73-b053-be9a2fa58b96
	Detects modification of autostart extensibility point (ASEP) in registry.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	medium	Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split)	2019-10-25	2023-08-17	a80f662f-022f-4429-9b8c-b1a41aaa6688
	Detects the setting of a new value in the Autorun key that is used by the Kapeka backdoor for persistence.	Emerging	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	Swachchhanda Shrawan Poudel	2024-07-03	—	c0c67b21-eb8a-4c84-a395-40473ec3b482
	Detects sideloading of trojanized DLLs used in Lazarus APT campaign in the case of a Spanish aerospa (...)	Emerging	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Thurein Oo, Nasreddine Bencherchali (Nextron Systems)	2023-10-18	—	24007168-a26b-4049-90d0-ce138e13a5cf
	Detects binaries used by the Lazarus group which use system names but are executed and launched from (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Stealth Masquerading Match Legitimate Resource Name or Location	-	high	Trent Liffick (@tliffick), Bartlomiej Czyz (@bczyz1)	2020-06-03	2023-03-10	3f7f5b0b-5b16-476c-a85f-ab477f6dd24b
	Detects registry key used by Leviathan APT in Malaysian focused campaign	Emerging	test	registry_event	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	critical	Aidan Bracher	2020-07-07	2023-09-19	70d43542-cd2d-483c-8f30-f16b436fd7db
Splunk	The following analytic detects suspicious Base64 decode operations that may indicate malicious activity, such as data exfiltration or execution of encoded commands. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Stealth Deobfuscate/Decode Files or Information	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	5890ba10-4e48-4dc0-8a40-3e1ebe75e737
	Detects suspicious process command line that uses base64 encoded input for execution with a shell	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	pH-T (Nextron Systems)	2022-07-26	2023-06-16	ba592c6d-6888-43c3-b8c6-689b8fe47337
	Detects the presence of a base64 version of the shebang in the commandline, which could indicate a m (...)	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-09-15	—	fe2f9663-41cb-47e2-b954-8a228f3b9dff
	Detects suspicious process command line that starts with a shell that executes something and finally (...)	Generic	test	process_creation	linux	Sysmon	Stealth Deobfuscate/Decode Files or Information	-	medium	Florian Roth (Nextron Systems)	2022-03-14	2022-07-26	880973f3-9708-491c-a77b-2a35a1921158
	Detects creation of a malicious DLL file in the location where the OneDrive or Team applications Upo (...)	Generic	test	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	frack113	2022-08-12	—	1908fcc1-1b92-4272-8214-0fbaf2fa5163
	Detects Code Integrity (CI) engine blocking Microsoft Defender's processes (MpCmdRun and NisSrv) fro (...)	Generic	test	-	windows	Security Mitigations	Execution, Stealth Hijack Execution Flow DLL	-	high	Bhabesh Raj	2022-08-02	2022-09-28	0b0ea3cc-99c8-4730-9c53-45deee2a4c86
	Detects DLL sideloading of DLLs that are part of Microsoft Office from non standard location	Generic	test	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	high	Nasreddine Bencherchali (Nextron Systems), Wietze Beukema (project and research)	2022-08-17	2023-03-15	829a3bdf-34da-4051-9cf4-8ed221a8ae4f
	Detect modification of the User Shell Folders registry values for Startup or Common Startup which could indicate persistence attempts. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder	-	high	frack113, Swachchhanda Shrawan Poudel (Nextron Systems)	2022-10-01	2026-01-05	9c226817-8dc9-46c2-a58d-66655aafd7dc
	Detects execution of mshta.exe with file types that looks like they do not typically represent HTA ( (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter JavaScript Stealth Deobfuscate/Decode Files or Information Stealth System Binary Proxy Execution Mshta	CVE-2020-1599	high	Diego Perez (@darkquassar), Markus Neis, Swisscom (Improve Rule), Swachchhanda Shrawan Poudel (Nextron Systems)	2019-02-22	2025-05-12	cc7abbd0-762b-41e3-8a26-57ad50d2eea3
Splunk	The following analytic detects the loading of `msi.dll` by a binary not located in `system32`, `syswow64`, `winsxs`, or `windows` directories. (...)	Hunting	stable	image_load	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	CVE-2021-41379	medium	Michael Haag, Splunk	2021-12-08	2026-05-13	ccb98a66-5851-11ec-b91c-acde48001122
Splunk	The following analytic detects the suspicious creation of msmpeng.exe or mpsvc.dll in non-default Windows Defender folders. (...)	Generic	stable	file_event	windows	Sysmon	Execution, Stealth Hijack Execution Flow DLL	-	medium	Teoderick Contreras, Splunk, Sanjay Govind	2021-07-05	2026-05-13	8bb3f280-dd9b-11eb-84d5-acde48001122

Title

Description

Chinoxy S1041

Chinoxy MITRE reference S1041

Standing S1041

Reach

Coverage

Chinoxy detections S1041