Malware

SilverFox

SilverFox, also known as Yinhu, is a Windows-focused remote-access Trojan ecosystem used in campaigns primarily targeting Chinese-speaking users and organizations. Operations have used spoofed software-download websites, SEO poisoning and watering-hole delivery, and instant-messaging spearphishing to distribute malware masquerading as legitimate software installers or business-themed documents. The activity has impersonated widely used productivity, remote-access, browser, security, and communications products.

SilverFox-related payloads employ DLL side-loading, staged in-memory payload execution, process injection and process hollowing, anti-debugging and virtual-machine evasion, code and configuration obfuscation, and security-tool impairment. Observed functions include host, process, file, and directory discovery; credential and email collection; keylogging; screen and clipboard capture; persistence through startup mechanisms, scheduled tasks, and services; and command-and-control-based data exfiltration. Some variants use RPC-based command-and-control communications and encrypted payloads or configuration data.

SilverFox activity has been associated with ValleyRAT, Winos 4.0, Gh0stRAT-derived tooling, HoldingHands, UTG-Q-1000, VoidArachne, and ValleyThief. Public reporting identifies overlap among these tools, but operator-level attribution remains unresolved.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

41 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1589.001CredentialsEvidence1

ATT&CK IDs: "T1589.001 - Credentials."

Resource Development

2 techniques

T1583.001DomainsEvidence1

All eleven 360news*.icu domains were bulk-registered on 2025-07-29 through Gname.com... The actor picked one cloud provider, one region, one registrar, and one personal Gmail account for the entire setup.

T1583.003Virtual Private ServerEvidence1

Every IP in that list, with the exception of 95.173.197.195, is Alibaba Cloud Hong Kong (AS45102). The actor picked one cloud provider, one region, one registrar, and one personal Gmail account for the entire setup.

Initial Access

5 techniques

T1189Drive-by CompromiseEvidence2

ATT&CK IDs: "T1189 - Drive-by Compromise."

T1566PhishingEvidence1

For twelve operationally-named domains to all land on the same registrant email without privacy — and for that email to be a personal gmail.com address rather than a burner — is an operator OPSEC failure of the kind that normally gets scrubbed before the first phishing sample ever leaves the author's workstation.

T1566.001Spearphishing AttachmentEvidence2

ATT&CK IDs: "T1566.001 - Spearphishing Attachment."

T1566.002Spearphishing LinkEvidence2

ATT&CK IDs: "T1566.002 - Spearphishing Link."

T1566.003Spearphishing via ServiceEvidence1

The actors leverage "spear-phishing campaigns across instant messaging (IM) platforms for initial access."

Execution

5 techniques

T1053.005Scheduled TaskEvidence1

ATT&CK IDs: "T1053.005 - Scheduled Task."

T1059Command and Scripting InterpreterEvidence1

ATT&CK IDs: "T1059 - Command and Scripting Interpreter."

T1059.001PowerShellEvidence2

ATT&CK IDs: "T1059.001 - PowerShell."

T1203Exploitation for Client ExecutionEvidence1

ATT&CK IDs: "T1203 - Exploitation for Client Execution."

T1204.002Malicious FileEvidence1

ATT&CK IDs: "T1204.002 - Malicious File."

Persistence

4 techniques

T1053.005Scheduled TaskEvidence1

ATT&CK IDs: "T1053.005 - Scheduled Task."

T1112Modify RegistryEvidence1

ATT&CK IDs: "T1112 - Modify Registry."

T1543.003Windows ServiceEvidence1

ATT&CK IDs: "T1543.003 - Windows Service."

T1547.001Registry Run Keys / Startup FolderEvidence1

ATT&CK IDs: "T1547.001 - Registry Run Keys / Startup Folder."

Privilege Escalation

5 techniques

T1053.005Scheduled TaskEvidence1

ATT&CK IDs: "T1053.005 - Scheduled Task."

T1055Process InjectionEvidence1

ATT&CK IDs: "T1055 - Process Injection."

T1055.012Process HollowingEvidence1

ATT&CK IDs: "T1055.012 - Process Hollowing."

T1543.003Windows ServiceEvidence1

ATT&CK IDs: "T1543.003 - Windows Service."

T1547.001Registry Run Keys / Startup FolderEvidence1

ATT&CK IDs: "T1547.001 - Registry Run Keys / Startup Folder."

Stealth

8 techniques

T1027Obfuscated Files or InformationEvidence1

ATT&CK IDs: "T1027 - Obfuscated Files or Information"; tags include "Code_Obfuscation."

T1036MasqueradingEvidence1

The name "360news" is a deliberate typosquat of Qihoo 360 (奇虎360), the largest Chinese cybersecurity vendor. Hosting fake "Qihoo 360 Security" download pages under a .icu TLD is low-effort social engineering...

T1036.005Match Legitimate Resource Name or LocationEvidence1

Defense Evasion Masquerading: Match Legitimate Name T1036.005 LNK uses Excel/RTF icons, chrome.exe name

T1055Process InjectionEvidence1

ATT&CK IDs: "T1055 - Process Injection."

T1055.012Process HollowingEvidence1

ATT&CK IDs: "T1055.012 - Process Hollowing."

T1070Indicator RemovalEvidence1

ATT&CK IDs: "T1070 - Indicator Removal on Host."

T1218System Binary Proxy ExecutionEvidence1

ATT&CK IDs: "T1218 - Signed Binary Proxy Execution."

T1497Virtualization/Sandbox EvasionEvidence2

ATT&CK IDs: "T1497 - Virtualization/Sandbox Evasion."

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

ATT&CK IDs: "T1112 - Modify Registry."

Credential Access

1 technique

T1056.001KeyloggingEvidence1

ATT&CK IDs: "T1056.001 - Keylogging."

Discovery

4 techniques

T1057Process DiscoveryEvidence1

ATT&CK IDs: "T1057 - Process Discovery."

T1082System Information DiscoveryEvidence1

ATT&CK IDs: "T1082 - System Information Discovery."

T1083File and Directory DiscoveryEvidence1

ATT&CK IDs: "T1083 - File and Directory Discovery."

T1497Virtualization/Sandbox EvasionEvidence2

ATT&CK IDs: "T1497 - Virtualization/Sandbox Evasion."

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

ATT&CK IDs: "T1021 - Remote Services."

Collection

5 techniques

T1005Data from Local SystemEvidence1

ATT&CK IDs: "T1005 - Data from Local System."

T1056.001KeyloggingEvidence1

ATT&CK IDs: "T1056.001 - Keylogging."

T1113Screen CaptureEvidence1

ATT&CK IDs: "T1113 - Screen Capture."

T1114Email CollectionEvidence1

ATT&CK IDs: "T1114 - Email Collection."

T1115Clipboard DataEvidence1

ATT&CK IDs: "T1115 - Clipboard Data."

Command and Control

6 techniques

T1071Application Layer ProtocolEvidence1

Two suggestive names — jackadmin reads like a C2 admin panel hostname, jackbank reads like a banking trojan overlay / fraud panel hostname — repeated five times each as a pre-provisioned batch for when the previous set gets burned.

T1071.001Web ProtocolsEvidence1

ATT&CK IDs: "T1071.001 - Web Protocols."

T1105Ingress Tool TransferEvidence1

Command and Control Ingress Tool Transfer T1105 BitsAdmin/PowerShell downloading payloads

T1568.002Domain Generation AlgorithmsEvidence1

The two random-string companions trnebaiek.cn and eijmdixci.cn are the classic Silver Fox random-string C2 domain shape.

T1571Non-Standard PortEvidence1

ATT&CK IDs: "T1571 - Non-Standard Port."

T1573Encrypted ChannelEvidence1

ATT&CK IDs: "T1573 - Encrypted Channel."

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

ATT&CK IDs: "T1041 - Exfiltration Over C2 Channel"; tags include "Data_Exfiltration" and "C2_Infrastructure."

Other

1 technique

T1562.001Disable or Modify ToolsEvidence1

ATT&CK IDs: "T1562.001 - Disable or Modify Tools."

INDICATORS OF COMPROMISE

IOCs tracked for this family

2,080 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1,927 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

128 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

25 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app6 days ago

uri●●●●●●●●●●●●View more in app6 days ago

hash.md5●●●●●●●●●●●●View more in app6 days ago

uri●●●●●●●●●●●●View more in app6 days ago

hash.md5●●●●●●●●●●●●View more in app6 days ago

ACTIVITY FEED

Recent activity

6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

6 SOURCESView more in app

alienvaultNews

Sep 1, 2026

SilverFox (银狐) - LevelBlue - Open Threat Exchange

A destructive remote-access trojan targeting Chinese organizations and users. It is distributed through spoofed legitimate-software websites and spear-phishing delivered through instant-messaging platforms.

derp ca blogNews

Jun 21, 2026

SilverFox-style loader chain: Panasonic shells, Alibaba OSS carriers, and a Sauron backdoor | Derp

A layered malware chain wrapped in a trojanized Panasonic host that reconstructs Alibaba OSS staging URLs, retrieves image-named encrypted carriers, performs signed DLL side-loading, uses RPC task scheduling, deploys AV-evasion/preparation logic, and ultimately reaches a late-stage backdoor component.

breakglass intelNews

Apr 3, 2026

Operation MIRZBOW - LNK Dropper Campaign Targeting Arabic-Speaking Users - Breakglass Intelligence - Breakglass Intelligence

SilverFox is described as a Chinese-origin infostealer/RAT associated with trojanized software. In this campaign, the final trojanized chrome.exe payload may be a SilverFox variant.

breakglass intelNews

Mar 16, 2026

SilverFox Deploys VM-Obfuscated RAT with ChaCha20 Encryption and RPC-Based C2 Disguised as Trend Micro - Breakglass Intelligence - Breakglass Intelligence

A SilverFox RAT variant disguised as a Trend Micro Titanium installer. It hides logic inside a custom virtual machine with a binary search tree dispatcher, uses ChaCha20/Salsa20-style encryption for code and C2 payloads, performs anti-debugging and anti-VM checks, decrypts code in memory, injects into processes, and communicates with operators over Windows MSRPC using NdrAsyncClientCall.

+2 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching2,080

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping41

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

SilverFox