Malware

JPIN

JPIN is a Windows malware family associated with the China-linked espionage group PLATINUM. It has been used in long-term cyber-espionage operations targeting government and related organizations in South and Southeast Asia. JPIN functions as a modular backdoor and surveillance implant that supports host reconnaissance, credential collection, and stealthy execution on compromised systems.

Observed capabilities include enumerating running processes and services, collecting the current username, gathering local network configuration details such as DNS, IP, and proxy information, and enumerating Windows Registry keys. JPIN also contains a custom keylogger and can lower host security settings through Registry modification, indicating both credential-access and defense-evasion functionality. In addition, it has been observed injecting content into lsass.exe to load a module, demonstrating process-injection behavior for stealth and execution within a trusted process.

JPIN includes anti-analysis and self-protection logic. Its installer or uninstaller component checks for the presence of security-related processes and deletes itself if such processes are detected. It also self-deletes when executed on unsupported legacy Windows versions earlier than Windows XP. Reporting on PLATINUM-linked tooling indicates JPIN is used to obtain system information, load a keylogger, download files and updates, and extract potentially sensitive files from victim environments.

The malware is best characterized as a backdoor used for post-compromise espionage, with integrated reconnaissance, keylogging, defense evasion, and module-loading capabilities.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

17 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

1 technique

T1059.003Windows Command ShellEvidence3

The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

Persistence

1 technique

T1112Modify RegistryEvidence2

Sandworm Team modified in-registry internet settings to lower internet security... Ember Bear disables Windows Defender via registry key changes... JPIN can lower security settings by changing Registry keys... POWERSTATS can disable Microsoft Office Protected View by changing Registry keys.

Privilege Escalation

1 technique

T1055Process InjectionEvidence2

The content repeatedly describes adversaries and malware injecting code, shellcode, DLLs, or payloads into legitimate processes such as svchost.exe, explorer.exe, iexplore.exe, wuauclt.exe, lsass.exe, and browser processes.

Stealth

4 techniques

T1027Obfuscated Files or InformationEvidence1

The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.

T1027.009Embedded PayloadsEvidence1

JPIN uses a encrypted and compressed payload that is disguised as a bitmap within the resource section of the installer. Ramsay has base64-encoded its portable executable and hidden itself under a JPG header. TEARDROP created and read from a file with a fake JPG header.

T1055Process InjectionEvidence2

T1070.004File DeletionEvidence7

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

Defense Impairment

1 technique

T1112Modify RegistryEvidence2

Credential Access

1 technique

T1056.001KeyloggingEvidence1

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

Discovery

8 techniques

T1012Query RegistryEvidence2

The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."

T1016System Network Configuration DiscoveryEvidence5

AdFind can extract subnet information from Active Directory; actors used ipconfig /all after exploiting a machine; numerous malware and groups used ipconfig, ifconfig, arp, route, netsh, nbtstat, NBTscan, and related APIs to gather IP, MAC, DNS, DHCP, gateway, proxy, domain, ARP cache, routing, and adapter details.

T1033System Owner/User DiscoveryEvidence5

The content repeatedly describes malware and threat actors collecting the victim username, identifying logged-in users, running whoami, query user, quser, or similar commands to determine the current user or user sessions.

T1057Process DiscoveryEvidence4

Tasklist can be used to discover processes running on a system. Numerous malware families and threat groups are described as listing running processes, collecting PIDs, checking for specific process names, or enumerating loaded modules.

T1082System Information DiscoveryEvidence7

The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."

T1083File and Directory DiscoveryEvidence4

The content is a long ATT&CK-style listing of groups and malware that can 'list files and directories,' 'search for files,' 'enumerate drives,' 'gather file metadata,' or 'browse file systems' on compromised hosts.

T1120Peripheral Device DiscoveryEvidence1

Numerous entries mention enumerating drives, logical disks, disk type, free space, or volume information; examples include 'Babuk can enumerate disk volumes,' 'Cuba can enumerate local drives,' and 'TAINTEDSCRIBE can use DriveList to retrieve drive information.'

T1518.001Security Software DiscoveryEvidence2

Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment.

Collection

1 technique

T1056.001KeyloggingEvidence1

The content is a catalog of malware families and threat actors that 'can perform keylogging,' 'log keystrokes,' 'capture keystrokes,' or use 'keylogger' modules/tools.

Command and Control

1 technique

T1105Ingress Tool TransferEvidence1

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

Other

1 technique

T1562Impair DefensesEvidence2

The content repeatedly describes threat actors and malware disabling, stopping, uninstalling, or modifying antivirus, EDR, Windows Defender, AMSI, logging, and other security controls.

ACTIVITY FEED

Recent activity

38 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

38 SOURCESView more in app

mitre attack websiteNews

Apr 25, 2023

Process Injection, Technique T1055 - Enterprise | MITRE ATT&CK®

Malware capable of injecting content into lsass.exe to load a module.

mitre attack websiteNews

Oct 25, 2022

System Owner/User Discovery, Technique T1033 - Enterprise | MITRE ATT&CK®

Backdoor that can obtain the victim username.

mitre attack websiteNews

Apr 25, 2022

System Network Configuration Discovery, Technique T1016 - Enterprise | MITRE ATT&CK®

Obtains network information including DNS, IP, and proxy settings.

mitre attack websiteNews

Oct 21, 2021

System Owner/User Discovery, Technique T1033 - Enterprise | MITRE ATT&CK®

Obtains the victim username.

+34 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping17

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

JPIN

The malware is best characterized as a backdoor used for post-compromise espionage, with integrated reconnaissance, keylogging, defense evasion, and module-loading capabilities.