Loading malware…
Denis is a backdoor also referred to as SOUNDBITE in the provided content. It is associated with OceanLotus/APT32 and is described as implementing DNS tunneling for command-and-control communications. Observed capabilities include querying Windows Registry keys and values for system information, enumerating and collecting the victim username, gathering the system IP address via ipconfig, decrypting strings used for C2 communication, Base64-encoding data sent to the server, deleting files from the victim machine, and anti-debugging behavior using IsDebuggerPresent, OutputDebugString, and SetLastError. The malware dynamically resolves APIs with LoadLibrary and GetProcAddress, and has been observed exploiting a security vulnerability to load a fake DLL and execute its code. It also performed process hollowing using CreateRemoteThread, ResumeThread, and Wow64SetThreadContext. The content further notes that Denis has a PowerShell version and that its PowerShell commands have been Base64-encoded.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Its well-known tools include Denis (aka SOUNDBITE), implementing DNS tunneling for C&C communications...
21 distinct techniques documented for this family, organized by ATT&CK tactic.
Key TTPs: DLL hollowing overwriting memory within legitimate xpsservices.dll system library for silent payload execution under trusted process name, Notion cloud platform as C2 channel embedding instructions within Notion pages, registry persistence and scheduled task creation
The content repeatedly describes threat actors and malware using PowerShell scripts/commands for execution, download, staging, reconnaissance, persistence, credential access, lateral movement, and defense evasion; e.g., "Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses."
The content repeatedly describes use of cmd.exe, cmd /c, Windows command shell, and xp_cmdshell to execute commands, run payloads, launch binaries, perform reconnaissance, persistence, cleanup, and ransomware actions. Examples include: 'Sandworm Team used the xp_cmdshell command in MS-SQL', 'APT41 used cmd.exe /c to execute commands on remote machines', and many malware families 'can use cmd.exe to execute commands on a compromised host.' | Many entries explicitly state malware 'can create a reverse shell' or 'launch a remote shell,' including 4H RAT, AuditCred, BLACKCOFFEE, Carbanak, DarkComet, Exaramel for Windows, PlugX, QuasarRAT, and ZxShell.
"AppleJeus ... has also used DLL search order hijacking via the IKEEXT service, running with LocalSystem privileges, to load the TAXHAUL DLL for persistence." / "APT41 ... has used search order hijacking to execute malicious payloads" / "Cinnamon Tempest has used search order hijacking to launch Cobalt Strike Beacons."
Key TTPs: DLL hollowing overwriting memory within legitimate xpsservices.dll system library for silent payload execution under trusted process name, Notion cloud platform as C2 channel embedding instructions within Notion pages, registry persistence and scheduled task creation
Key TTPs: DLL hollowing overwriting memory within legitimate xpsservices.dll system library for silent payload execution under trusted process name, Notion cloud platform as C2 channel embedding instructions within Notion pages, registry persistence and scheduled task creation
The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.
"Denis ... used the Wow64SetThreadContext API as part of a process hollowing process"; "DarkGate can call kernel mode functions directly to hide the use of process hollowing methods"
The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
DLL hollowing overwriting memory within legitimate xpsservices.dll system library for silent payload execution under trusted process name
"AppleJeus ... has also used DLL search order hijacking via the IKEEXT service, running with LocalSystem privileges, to load the TAXHAUL DLL for persistence." / "APT41 ... has used search order hijacking to execute malicious payloads" / "Cinnamon Tempest has used search order hijacking to launch Cobalt Strike Beacons."
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
Notion cloud platform as C2 channel embedding instructions within Notion pages
26 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Backdoor used by OceanLotus that implements DNS tunneling for command-and-control communications.
Backdoor listed as part of the OceanLotus malware toolkit used in campaigns targeting Chinese entities.
Backdoor with a PowerShell-based variant.
Malware that encodes its PowerShell commands in Base64.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.