Loading malware…
Winos, also known as WinOS or ValleyRAT, is a modular Windows remote-access trojan and command-and-control framework, commonly associated with the Silver Fox cybercrime ecosystem. Winos 4.0 is implemented in C++ and uses stagers and extensible plugins, with both 32-bit and 64-bit components reported. It provides remote shell access, command and file execution, file management and disk searching, process and service management, screenshot capture, webcam and microphone control, clipboard collection, keylogging, and system shutdown or restart functions. Plugins and associated components have supported process injection, privilege escalation, startup and scheduled-task persistence, internal-network scanning, credential theft from locally stored application accounts, log clearing, and DDoS functionality. It collects host profiling data, including system, security-product, network, and hardware information, and incorporates checks for analysis and monitoring tools. Winos has been deployed through trojanized Windows software installers, including MSI and EXE packages that install a legitimate-looking application while deploying the implant. Observed lure themes include VPN services, browsers, messaging applications, translation utilities, office software, AI tools, and fake Flash updates. Distribution has included search-engine-optimized counterfeit download sites, phishing pages, and Chinese-language Telegram channels. Activity delivering Winos has been attributed or linked to Silver Fox-associated operators, Void Arachne, and APT-Q-27 (Golden Eye Dog), primarily affecting Chinese-speaking users and organizations in Asia. The malware has also been used against gambling-sector personnel and victims in technology, education, state-owned enterprises, and other Chinese industry sectors.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The comparison table lists “ValleyRAT / Winos 4.0” as the documented Silver Fox final stage, contrasted with VenomRAT in this sample.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
所有搜索了特定仿冒软件的人都有可能下载到伪装的恶意安装包。 | 金眼狗团伙曾多次利用水坑网站托管恶意软件安装包,向受害者设备植入木马。金眼狗通过部署虚假的软件下载网站,再配合不同方式诱导受害者下载安装其恶意程序。
MITRE ATT&CK Mapping Tactic Technique ID Notes Initial Access Supply Chain Compromise T1195.002 Trojanized Chinese software distribution
After the second-stage loader (file “1”) is executed and loaded into memory, the malware drops a Visual Basic Script (VBScript) designed to automate the creation of a scheduled task within Windows Task Scheduler to achieve persistence.
The malware also uses the netsh command to set up port forwarding and configure firewall rules named “Safe<integer>” on the victim’s machine
the malware drops a Visual Basic Script (VBScript) designed to automate the creation of a scheduled task within Windows Task Scheduler
After decryption, the core function of the shellcode in Xps.dtd is to load the included PE and jump to the run export function to execute.
After the second-stage loader (file “1”) is executed and loaded into memory, the malware drops a Visual Basic Script (VBScript) designed to automate the creation of a scheduled task within Windows Task Scheduler to achieve persistence.
the stager then saves the decrypted C&C server response (the plugin and its configuration) into the Windows Registry. It uses the name "d33f351a4aeea5e608853d1a56661059" and stores it under the key path HKEY_CURRENT_USER\Console\0
After the second-stage loader (file “1”) is executed and loaded into memory, the malware drops a Visual Basic Script (VBScript) designed to automate the creation of a scheduled task within Windows Task Scheduler to achieve persistence.
Additionally, it supports many functionalities including process injection and microphone recording
Additionally, it supports many functionalities including process injection and microphone recording
The loader uses the Rivest Cipher 4 (RC4) algorithm with the key "0x678E0B00" to decrypt this data. After decryption, the payload, which is now executable code, is mapped into the process's memory space and executed.
If this feature is configured, the malware verifies the presence of monitoring software by inspecting the window titles of running processes. If such software is detected, the malware enters sleep mode.
the stager then saves the decrypted C&C server response (the plugin and its configuration) into the Windows Registry. It uses the name "d33f351a4aeea5e608853d1a56661059" and stores it under the key path HKEY_CURRENT_USER\Console\0
During our investigation, we found the following external and custom plugins for Winos 4.0 in the wild: ... 内网主机扫描.dll Internal Network Host Scan.dll
The malware collects system information from an infected machine, including the IP address, computer name, antivirus software, operating system details, and hardware ID (HWID).
Winos has features that include file management, distributed denial of service (DDoS) using TCP/UDP/ ICMP/HTTP, full disk search
The malware also uses the netsh command to set up port forwarding... Specifically, it designates port 443 as the listening port on the local machine
159 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as a malware payload associated with documented Silver Fox activity for comparison purposes only.
A Windows backdoor/C2 framework used by Chinese threat actors for full remote control of compromised systems. In this campaign it is delivered via malicious MSI installers and supports file management, DDoS, webcam and microphone access, screen capture, process injection, remote shell, keylogging, plugin loading, and registry-based storage of modules.
A remote access trojan, also referred to as ValleyRAT, used in related distributor activity tied to the broader Silver Fox ecosystem.
Malware family referenced in SEO poisoning/GitHub Pages distribution campaigns targeting Chinese-speaking users; no further details in excerpt.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.