MalwareUsed by 1 actor

10FXRAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Silver Fox

10FXRATはモジュール(プラグイン)型のマルウェアであり、必要な機能を動的に追加・実行できる仕組みを備えています。

via lac watchlac.co.jp

MITRE ATT&CK

Techniques & procedures

28 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566.001Spearphishing AttachmentEvidence1

LAC WATCH report published 2026-06-04 describing a spearphishing campaign against organizations in Japan and China that chains a malicious LNK downloader into the PoisonX BYOVD driver, a PXDropper component, and the 10FXRAT remote-access trojan.

T1566.002Spearphishing LinkEvidence2

The full chain begins with a spear-phishing email (often HR-themed) linking to a ZIP/RAR on Google Cloud Storage.

Execution

5 techniques

T1059Command and Scripting InterpreterEvidence1

0x02 リモートシェルの実行

T1059.001PowerShellEvidence1

レジストリ操作に失敗した場合は、下記PowerShellのコマンドレットを用いて追加を試みます。「powershell.exe -NoP -NonI -W Hidden -C "Add-MpPreference -ExclusionPath ..."」

T1106Native APIEvidence1

このデバイスインタフェースを利用する主な目的は、セキュリティ製品の無効化(0x22E010 IOCTL)と、自分自身のプロセスおよびネットワーク通信の隠蔽(0x22E008 IOCTL)です。

T1204.002Malicious FileEvidence1

An LNK shortcut runs curl.exe to fetch the ‘PXDropper’ component, which writes PoisonX.sys and the 10FXRAT implant...

T1574Hijack Execution FlowEvidence1

the signed host side-loads the attacker DLL, which decrypts the bundled cache to stage the driver and RAT.

Persistence

3 techniques

T1112Modify RegistryEvidence1

スキャン除外パスの登録... HKLM¥SOFTWARE¥Microsoft¥Windows Defender¥Exclusions¥Paths ... リアルタイム保護と振る舞い監視の無効化 ... HKLM¥SOFTWARE¥Policies¥Microsoft¥Windows Defender¥Real-Time Protection ... クラウド連携およびサンプル自動送信のブロック ... HKLM¥SOFTWARE¥Policies¥Microsoft¥Windows Defender¥Spynet

T1543.003Windows ServiceEvidence1

その後、ファイル名と同じ名称でWindowsサービスとして登録し、このサービスを起動します。... 「DevCfgCC.sys」というファイル名で永続化ディレクトリへ書き出し、OSの起動時に自動的に読み込まれるよう、システムにサービスとして登録します。

T1547.001Registry Run Keys / Startup FolderEvidence2

...establishes persistence via Run keys...

Privilege Escalation

2 techniques

T1543.003Windows ServiceEvidence1

T1547.001Registry Run Keys / Startup FolderEvidence2

...establishes persistence via Run keys...

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

マルウェア内部にハードコードされている暗号化された10FXRAT関連ファイル...を、Incremental XORを用いて復号します。

T1027.007Dynamic API ResolutionEvidence1

本マルウェアはAPI Hashingテクニックを用いており、必要なWindows APIのアドレスを実行時にハッシュ値から動的解決します。

T1070Indicator RemovalEvidence1

これを受け取ったドライバは、WindowsのカーネルAPIや、正規のネットワーク監視ドライバ(¥Driver¥nsiproxy、¥Device¥Tcpなど)をフックし、指定されたPIDのプロセス情報と通信記録をシステムから除外します。これにより、OSのプロセス一覧から自身の存在を消し去り、タスクマネージャーやEDR等の各種システム監視ツールから、プロセスおよびC2サーバとの不正な通信活動を隠蔽することが可能となります。

T1140Deobfuscate/Decode Files or InformationEvidence1

the signed host side-loads the attacker DLL, which decrypts the bundled cache to stage the driver and RAT.

T1574Hijack Execution FlowEvidence1

the signed host side-loads the attacker DLL, which decrypts the bundled cache to stage the driver and RAT.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Credential Access

1 technique

T1056.001KeyloggingEvidence1

これにより、キーロガーやクリップボードの監視、暗号資産ウォレットの窃取、Telegram関連の情報窃取といった、より多様な攻撃タスクの実行が可能になります。

Discovery

5 techniques

T1007System Service DiscoveryEvidence1

GET_SERVICES - Windowsの全サービスの一覧と稼働状態を取得

T1010Application Window DiscoveryEvidence1

windowTitle 現在ユーザーが操作しているアクティブウィンドウのタイトル

T1057Process DiscoveryEvidence1

マルウェアは稼働中のプロセスを列挙し...セキュリティ製品のリストと照合します。

T1082System Information DiscoveryEvidence1

初期通信で送信するデータ ... computerName, userName, os, arch, cpuCores, memoryMB, isAdmin, integrity, hasCamera, windowTitle, installDate ...

T1518.001Security Software DiscoveryEvidence1

Enumerates running security products to select termination targets.

Collection

2 techniques

T1056.001KeyloggingEvidence1

T1115Clipboard DataEvidence1

これにより、キーロガーやクリップボードの監視、暗号資産ウォレットの窃取...

Command and Control

5 techniques

T1071Application Layer ProtocolEvidence1

101.32.190.202 ip 10FXRAT C2 ... The 12 C2 IPs combine with the 10FXRAT samples as the callback set

T1090ProxyEvidence2

10FXRAT sets up an internal SOCKS5 proxy for traffic forwarding.

T1095Non-Application Layer ProtocolEvidence1

10FXRATは、独自プロトコルを使用してTCP通信を行います。通信プロトコルは、「12バイトの固定長ヘッダ」と「可変長のペイロード(データ本体)」で構成されています。

T1105Ingress Tool TransferEvidence1

C2サーバからモジュールをダウンロードして読み込むことで、自身の機能を柔軟に拡張することが可能です。

T1219Remote Access ToolsEvidence1

10FXRAT is a modular HTTP/S remote access tool...

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

初期通信の例です。... JSONフォーマットで...感染端末に含まれる様々なデータを送信します。

Other

1 technique

T1562Impair DefensesEvidence1

セキュリティ製品の無効化については、マルウェアは稼働中のプロセスを列挙し...標的プロセスを発見すると...カーネル権限で対象のプロセスを強制終了(Kill)させます。

INDICATORS OF COMPROMISE

IOCs tracked for this family

64 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

12 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

49 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app2 months ago

ip.v4●●●●●●●●●●●●View more in app2 months ago

hash.sha256●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

alpha cyber blogNews

Jul 4, 2026

PoisonX Rootkit: A Signed Kernel Driver That Turns Your EDR Into a Target - Alpha Cyber

A modular HTTP/S remote access tool delivered with PoisonX that establishes encrypted C2, sets up an internal SOCKS5 proxy, and supports file exfiltration, lateral movement, keylogging, and credential theft.

lac watchNews

Jun 4, 2026

PoisonXドライバを用いた日本組織への攻撃キャンペーン | LAC WATCH

モジュール型RATで、システム情報収集、任意コマンド実行、SOCKS5トンネリング、プラグインの動的取得に対応する。追加機能としてキーロガー、クリップボード監視、暗号資産ウォレット窃取、Telegram情報窃取、hVNC、権限昇格などが想定される。

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching64

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping28

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

10FXRAT

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Silver Fox

10FXRATはモジュール(プラグイン)型のマルウェアであり、必要な機能を動的に追加・実行できる仕組みを備えています。

via lac watchlac.co.jp

MITRE ATT&CK

Techniques & procedures

28 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

2 techniques

T1566.001Spearphishing AttachmentEvidence1

T1566.002Spearphishing LinkEvidence2

The full chain begins with a spear-phishing email (often HR-themed) linking to a ZIP/RAR on Google Cloud Storage.

Execution

5 techniques

T1059Command and Scripting InterpreterEvidence1

0x02 リモートシェルの実行

T1059.001PowerShellEvidence1

T1106Native APIEvidence1

T1204.002Malicious FileEvidence1

An LNK shortcut runs curl.exe to fetch the ‘PXDropper’ component, which writes PoisonX.sys and the 10FXRAT implant...

T1574Hijack Execution FlowEvidence1

the signed host side-loads the attacker DLL, which decrypts the bundled cache to stage the driver and RAT.

Persistence

3 techniques

T1112Modify RegistryEvidence1

T1543.003Windows ServiceEvidence1

T1547.001Registry Run Keys / Startup FolderEvidence2

...establishes persistence via Run keys...

Privilege Escalation

2 techniques

T1543.003Windows ServiceEvidence1

T1547.001Registry Run Keys / Startup FolderEvidence2

...establishes persistence via Run keys...

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

マルウェア内部にハードコードされている暗号化された10FXRAT関連ファイル...を、Incremental XORを用いて復号します。

T1027.007Dynamic API ResolutionEvidence1

本マルウェアはAPI Hashingテクニックを用いており、必要なWindows APIのアドレスを実行時にハッシュ値から動的解決します。

T1070Indicator RemovalEvidence1

T1140Deobfuscate/Decode Files or InformationEvidence1

the signed host side-loads the attacker DLL, which decrypts the bundled cache to stage the driver and RAT.

T1574Hijack Execution FlowEvidence1

the signed host side-loads the attacker DLL, which decrypts the bundled cache to stage the driver and RAT.

Defense Impairment

1 technique

T1112Modify RegistryEvidence1

Credential Access

1 technique

T1056.001KeyloggingEvidence1

Discovery

5 techniques

T1007System Service DiscoveryEvidence1

GET_SERVICES - Windowsの全サービスの一覧と稼働状態を取得

T1010Application Window DiscoveryEvidence1

windowTitle 現在ユーザーが操作しているアクティブウィンドウのタイトル

T1057Process DiscoveryEvidence1

マルウェアは稼働中のプロセスを列挙し...セキュリティ製品のリストと照合します。

T1082System Information DiscoveryEvidence1

初期通信で送信するデータ ... computerName, userName, os, arch, cpuCores, memoryMB, isAdmin, integrity, hasCamera, windowTitle, installDate ...

T1518.001Security Software DiscoveryEvidence1

Enumerates running security products to select termination targets.

Collection

2 techniques

T1056.001KeyloggingEvidence1

T1115Clipboard DataEvidence1

これにより、キーロガーやクリップボードの監視、暗号資産ウォレットの窃取...

Command and Control

5 techniques

T1071Application Layer ProtocolEvidence1

101.32.190.202 ip 10FXRAT C2 ... The 12 C2 IPs combine with the 10FXRAT samples as the callback set

T1090ProxyEvidence2

10FXRAT sets up an internal SOCKS5 proxy for traffic forwarding.

T1095Non-Application Layer ProtocolEvidence1

T1105Ingress Tool TransferEvidence1

C2サーバからモジュールをダウンロードして読み込むことで、自身の機能を柔軟に拡張することが可能です。

T1219Remote Access ToolsEvidence1

10FXRAT is a modular HTTP/S remote access tool...

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

初期通信の例です。... JSONフォーマットで...感染端末に含まれる様々なデータを送信します。

Other

1 technique

T1562Impair DefensesEvidence1

INDICATORS OF COMPROMISE

IOCs tracked for this family

64 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

12 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

49 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

3 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app2 months ago

ip.v4●●●●●●●●●●●●View more in app2 months ago

hash.sha256●●●●●●●●●●●●View more in app2 months ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

alpha cyber blogNews

Jul 4, 2026

PoisonX Rootkit: A Signed Kernel Driver That Turns Your EDR Into a Target - Alpha Cyber

lac watchNews

Jun 4, 2026

PoisonXドライバを用いた日本組織への攻撃キャンペーン | LAC WATCH

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching64

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping28

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.