Loading malware…
Gelsemium is a Windows malware family associated in the provided content with the Chinese threat group Gelsemium. Reported aliases include Gelsemine, Gelsenicine, and Gelsevirine. The content describes a multi-stage infection chain in which the first stage, referred to as Gelsemine, is a large C++ dropper built with MFC. Gelsemium can use custom shellcode to map embedded DLLs into memory, collect data from compromised hosts, and communicate with command-and-control infrastructure over TCP and UDP.
The malware includes multiple defense-evasion and anti-analysis capabilities. It can open random files and Registry keys and use junk code to generate random activity to obscure behavior from sandbox analysis. It can check for the presence of specific security products, perform timestomping of files, distinguish between standard-user and administrator contexts, and bypass UAC to elevate privileges; the content also notes token manipulation to bypass UAC on Windows 7 systems.
Gelsemium uses the Windows Registry extensively. It can modify the Registry and store its components there. The content notes persistence via a Registry value named "Chrome Update" to appear legitimate. Named malicious binaries include serv.exe, winprint.dll, and chrome_elf.dll.
For persistence, Gelsemium can drop itself as C:\Windows\System32\spool\prtprocs\x64\winprint.dll as an alternative Print Processor so it is loaded automatically when the spoolsv Windows service starts.
The content also references code overlap between OwlProxy and Gelsevirine. In that reporting, ESET attributed Gelsevirine to the Chinese group Gelsemium. No additional high-confidence IOC values beyond the filenames, Registry value name, and print processor path are directly provided in the content.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Gelsenicine: The loader Gelsenicine is a loader that retrieves Gelsevirine and executes it. | Gelsevirine: The main plug-in Gelsevirine is the last stage of the chain and it is called MainPlugin by its developers, according to the DLL name and also PDB path found in old samples. | Gelsemine: The dropper Gelsemium’s first stage is a large dropper written in C++ using the Microsoft Foundation Class library (MFC).
30 distinct techniques documented for this family, organized by ATT&CK tactic.
Operation NightScout (BigNox): In January 2021, another ESET researcher analyzed and wrote an article about Operation NightScout; a supply-chain attack compromising the update mechanism of NoxPlayer, an Android emulator for PCs and Macs, and part of BigNox’s product range with over 150 million users worldwide.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the xp_cmdshell command in MS-SQL. During the 2025 Poland Wiper Attacks, the adversaries leveraged PsExec to run cmd.exe commands on multiple victim machines. Numerous malware families and groups are described as using cmd.exe, cmd /c, Windows command shell, or command-line interfaces to execute commands, payloads, reconnaissance, persistence, cleanup, and ransomware actions. | APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution. Blue Mockingbird has used batch script files to automate execution and deployment of payloads. During HomeLand Justice, threat actors used Windows batch files for persistence and execution.
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
“Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer… replaced the ImagePath registry value of a Windows service with a new backdoor binary… [multiple groups/malware] creating a service / installing as a service / modifying service configurations for persistence.”
“Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer… replaced the ImagePath registry value of a Windows service with a new backdoor binary… [multiple groups/malware] creating a service / installing as a service / modifying service configurations for persistence.”
Numerous malware families and threat groups are described as achieving persistence by adding values under Run/RunOnce/Policies\Explorer\Run Registry keys or by placing shortcuts/files in the Windows Startup folder.
"Action RAT's commands, strings, and domains can be Base64 encoded within the payload." / "ADVSTORESHELL... strings... encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed." / "APT29 has used encoded PowerShell commands." / "APT41 used VMProtected binaries..."
Examples include: “ComRAT has encrypted and stored its orchestrator code in the Registry…”, “ShadowPad maintains a configuration block and virtual file system in the Registry.”, and “QakBot can store its configuration information…under HKCU\Software\Microsoft.”
Gelsemium can use junk code to generate random activity to obscure malware behavior.
During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.
Akira has used legitimate names and locations for files to evade defenses.
Anchor has used cmd.exe to run its self deletion routine. Gelsemium can use a batch script to delete itself. Pony has used batch scripts to delete itself after execution. Lazarus Group used a batch file mechanism to delete its binaries from the system.
APT28 has performed timestomping on victim files. APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory. APT32 has used scheduled task raw XML with a backdated timestamp... APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
FinFisher queries Registry values as part of its anti-sandbox checks.
Users with standard privileges compromised by Gelsemine drop Gelsenicine under a different directory that does not require administrator privileges. The DLL chrome_elf.dll is dropped under %CommonAppData%/Google/Chrome/Application/Library/.
"Brute Ratel C4 has used reflective loading to execute malicious DLLs." / "Cobalt Strike's execute-assembly command can run a .NET executable within the memory of a sacrificial process..." / "FoggyWeb's loader has reflectively loaded .NET-based assembly/payloads into memory."
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe ... AADInternals can modify registry keys ... ADVSTORESHELL is capable of setting and deleting Registry values ... [many additional examples].
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
The content repeatedly describes malware and threat actors collecting usernames, identifying logged-in users, running whoami/query user/quser, checking whether the current user is an administrator, enumerating user sessions, and gathering account details from compromised hosts.
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content notes checks for whether the current user is an administrator or privileged, including 'AsyncRAT can check if the current user of a compromised system is an administrator,' 'Gelsemium has the ability to distinguish between a standard user and an administrator,' and 'Wizard Spider has used whoami to identify the local user and their privileges.'
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
The content repeatedly describes threat actors and malware collecting, stealing, identifying, copying, or staging files, documents, credentials, logs, databases, and other information from compromised hosts or local systems.
Examples in the content include malware extracting or unpacking ZIP, RAR, CAB, tar.gz, and other archived content, such as 'Emotet has used a self-extracting RAR file to deliver modules to victims' and 'Rocke has extracted tar.gz files after downloading them from a C2 server.'
35 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware with file timestomping capability on compromised systems.
OwlProxy ... has a code overlap with the malware called “Gelsevirine” attributed by the security firm “Eset” to the Chinese group “Gelsemium”.
First-stage dropper in the Gelsemium malware chain. It contains multiple embedded executables, uses zlib compression, and drops different subsequent stages depending on victim system characteristics such as architecture and privilege level.
Malware that persists by abusing the Print Processor mechanism tied to the print spooler service.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.