SYMBOLCOMMON_NAMEaka. SYNONYMS
win.chinoxy (Back to overview)

Chinoxy


There is no description at this point.

References
2022-08-22FortinetShunichi Imano, Fred Gutierrez
@online{imano:20220822:tale:9a74924, author = {Shunichi Imano and Fred Gutierrez}, title = {{A Tale of PivNoxy and Chinoxy Puppeteer}}, date = {2022-08-22}, organization = {Fortinet}, url = {https://www.fortinet.com/blog/threat-research/pivnoxy-and-chinoxy-puppeteer-analysis}, language = {English}, urldate = {2022-08-28} } A Tale of PivNoxy and Chinoxy Puppeteer
Chinoxy Poison Ivy
2022-07-14ProofpointCrista Giering, Joshua Miller, Michael Raggi, Proofpoint Threat Research Team
@online{giering:20220714:above:06891ca, author = {Crista Giering and Joshua Miller and Michael Raggi and Proofpoint Threat Research Team}, title = {{Above the Fold and in Your Inbox: Tracing State-Aligned Activity Targeting Journalists, Media}}, date = {2022-07-14}, organization = {Proofpoint}, url = {https://www.proofpoint.com/us/blog/threat-insight/above-fold-and-your-inbox-tracing-state-aligned-activity-targeting-journalists}, language = {English}, urldate = {2022-07-15} } Above the Fold and in Your Inbox: Tracing State-Aligned Activity Targeting Journalists, Media
Chinoxy
2021-12-08Recorded FutureInsikt Group®
@techreport{group:20211208:chinese:98ded4d, author = {Insikt Group®}, title = {{Chinese State-Sponsored Cyber Espionage Activity Supports Expansion of Regional Power and Influence in Southeast Asia}}, date = {2021-12-08}, institution = {Recorded Future}, url = {https://go.recordedfuture.com/hubfs/reports/cta-2021-1208.pdf}, language = {English}, urldate = {2021-12-23} } Chinese State-Sponsored Cyber Espionage Activity Supports Expansion of Regional Power and Influence in Southeast Asia
Chinoxy FunnyDream
2021-02-28PWC UKPWC UK
@techreport{uk:20210228:cyber:bd780cd, author = {PWC UK}, title = {{Cyber Threats 2020: A Year in Retrospect}}, date = {2021-02-28}, institution = {PWC UK}, url = {https://www.pwc.co.uk/cyber-security/pdf/pwc-cyber-threats-2020-a-year-in-retrospect.pdf}, language = {English}, urldate = {2021-03-04} } Cyber Threats 2020: A Year in Retrospect
elf.wellmess FlowerPower PowGoop 8.t Dropper Agent.BTZ Agent Tesla Appleseed Ave Maria Bankshot BazarBackdoor BLINDINGCAN Chinoxy Conti Cotx RAT Crimson RAT DUSTMAN Emotet FriedEx FunnyDream Hakbit Mailto Maze METALJACK Nefilim Oblique RAT Pay2Key PlugX QakBot REvil Ryuk StoneDrill StrongPity SUNBURST SUPERNOVA TrickBot TurlaRPC Turla SilentMoon WastedLocker WellMess Winnti ZeroCleare APT10 APT23 APT27 APT31 APT41 BlackTech BRONZE EDGEWOOD Inception Framework MUSTANG PANDA Red Charon Red Nue Tonto Team
2021-01-04nao_sec blognao_sec
@online{naosec:20210104:royal:041b9d3, author = {nao_sec}, title = {{Royal Road! Re:Dive}}, date = {2021-01-04}, organization = {nao_sec blog}, url = {https://nao-sec.org/2021/01/royal-road-redive.html}, language = {English}, urldate = {2021-01-05} } Royal Road! Re:Dive
8.t Dropper Chinoxy FlowCloud FunnyDream Lookback
2020-12-15Trend MicroLenart Bermejo, Gilbert Sison, Buddy Tancio
@techreport{bermejo:20201215:finding:f68f005, author = {Lenart Bermejo and Gilbert Sison and Buddy Tancio}, title = {{Finding APTX: Attacks via MITRE TTPs}}, date = {2020-12-15}, institution = {Trend Micro}, url = {https://documents.trendmicro.com/assets/white_papers/wp-finding-APTX-attributing-attacks-via-MITRE-TTPs.pdf}, language = {English}, urldate = {2020-12-17} } Finding APTX: Attacks via MITRE TTPs
Chinoxy
2020-11-16BitdefenderVictor Vrabie, Liviu Arsene
@techreport{vrabie:20201116:dissecting:1b39d4d, author = {Victor Vrabie and Liviu Arsene}, title = {{Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions}}, date = {2020-11-16}, institution = {Bitdefender}, url = {https://www.bitdefender.com/files/News/CaseStudies/study/379/Bitdefender-Whitepaper-Chinese-APT.pdf}, language = {English}, urldate = {2020-11-18} } Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions
Chinoxy FunnyDream
2020-09-16RiskIQJon Gross
@online{gross:20200916:riskiq:da4b864, author = {Jon Gross}, title = {{RiskIQ: Adventures in Cookie Land - Part 2}}, date = {2020-09-16}, organization = {RiskIQ}, url = {https://community.riskiq.com/article/56fa1b2f}, language = {English}, urldate = {2020-09-23} } RiskIQ: Adventures in Cookie Land - Part 2
8.t Dropper Chinoxy Poison Ivy
2020-08-19RiskIQJon Gross, Cory Kennedy
@online{gross:20200819:riskiq:94e5ccf, author = {Jon Gross and Cory Kennedy}, title = {{RiskIQ Adventures in Cookie Land - Part 1}}, date = {2020-08-19}, organization = {RiskIQ}, url = {https://community.riskiq.com/article/5fe2da7f}, language = {English}, urldate = {2020-09-23} } RiskIQ Adventures in Cookie Land - Part 1
8.t Dropper Chinoxy
2020-07-08Medium (@sevdraven)Sébastien Larinier
@online{larinier:20200708:how:7d692bb, author = {Sébastien Larinier}, title = {{How to unpack Chinoxy backdoor and decipher the configuration of the backdoor}}, date = {2020-07-08}, organization = {Medium (@sevdraven)}, url = {https://medium.com/@Sebdraven/how-to-unpack-chinoxy-backdoor-and-decipher-the-configuration-of-the-backdoor-4ffd98ca2a02}, language = {English}, urldate = {2020-07-11} } How to unpack Chinoxy backdoor and decipher the configuration of the backdoor
Chinoxy
2020-03-20Medium SebdravenSébastien Larinier
@online{larinier:20200320:new:3da1211, author = {Sébastien Larinier}, title = {{New version of chinoxy backdoor using COVID19 alerts document lure}}, date = {2020-03-20}, organization = {Medium Sebdraven}, url = {https://medium.com/@Sebdraven/new-version-of-chinoxy-backdoor-using-covid19-document-lure-83fa294c0746}, language = {English}, urldate = {2020-03-26} } New version of chinoxy backdoor using COVID19 alerts document lure
8.t Dropper Chinoxy
Yara Rules
[TLP:WHITE] win_chinoxy_auto (20221125 | Detects win.chinoxy.)
rule win_chinoxy_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-11-21"
        version = "1"
        description = "Detects win.chinoxy."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chinoxy"
        malpedia_rule_date = "20221118"
        malpedia_hash = "e0702e2e6d1d00da65c8a29a4ebacd0a4c59e1af"
        malpedia_version = "20221125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 5d 5b 83c410 c3 8b542434 55 52 }
            // n = 7, score = 100
            //   5d                   | pop                 ebp
            //   5b                   | pop                 ebx
            //   83c410               | add                 esp, 0x10
            //   c3                   | ret                 
            //   8b542434             | mov                 edx, dword ptr [esp + 0x34]
            //   55                   | push                ebp
            //   52                   | push                edx

        $sequence_1 = { c744241400000000 743f 57 56 8bc8 e8???????? }
            // n = 6, score = 100
            //   c744241400000000     | mov                 dword ptr [esp + 0x14], 0
            //   743f                 | je                  0x41
            //   57                   | push                edi
            //   56                   | push                esi
            //   8bc8                 | mov                 ecx, eax
            //   e8????????           |                     

        $sequence_2 = { 894a08 894804 85ff 740a 83c704 57 ff15???????? }
            // n = 7, score = 100
            //   894a08               | mov                 dword ptr [edx + 8], ecx
            //   894804               | mov                 dword ptr [eax + 4], ecx
            //   85ff                 | test                edi, edi
            //   740a                 | je                  0xc
            //   83c704               | add                 edi, 4
            //   57                   | push                edi
            //   ff15????????         |                     

        $sequence_3 = { 894618 eb15 8bcb 33c0 8bd1 }
            // n = 5, score = 100
            //   894618               | mov                 dword ptr [esi + 0x18], eax
            //   eb15                 | jmp                 0x17
            //   8bcb                 | mov                 ecx, ebx
            //   33c0                 | xor                 eax, eax
            //   8bd1                 | mov                 edx, ecx

        $sequence_4 = { 8bc1 33d2 8b4c2404 894804 83c9ff 895008 89480c }
            // n = 7, score = 100
            //   8bc1                 | mov                 eax, ecx
            //   33d2                 | xor                 edx, edx
            //   8b4c2404             | mov                 ecx, dword ptr [esp + 4]
            //   894804               | mov                 dword ptr [eax + 4], ecx
            //   83c9ff               | or                  ecx, 0xffffffff
            //   895008               | mov                 dword ptr [eax + 8], edx
            //   89480c               | mov                 dword ptr [eax + 0xc], ecx

        $sequence_5 = { eb01 56 ffd7 8bf0 83c408 85f6 }
            // n = 6, score = 100
            //   eb01                 | jmp                 3
            //   56                   | push                esi
            //   ffd7                 | call                edi
            //   8bf0                 | mov                 esi, eax
            //   83c408               | add                 esp, 8
            //   85f6                 | test                esi, esi

        $sequence_6 = { e8???????? 83c40c 6a00 6800100000 6a00 50 e8???????? }
            // n = 7, score = 100
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   6a00                 | push                0
            //   6800100000           | push                0x1000
            //   6a00                 | push                0
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_7 = { 85c0 742b 8b551c 52 56 ff15???????? }
            // n = 6, score = 100
            //   85c0                 | test                eax, eax
            //   742b                 | je                  0x2d
            //   8b551c               | mov                 edx, dword ptr [ebp + 0x1c]
            //   52                   | push                edx
            //   56                   | push                esi
            //   ff15????????         |                     

        $sequence_8 = { 8bf9 33db c744241410590110 8d6f08 3beb }
            // n = 5, score = 100
            //   8bf9                 | mov                 edi, ecx
            //   33db                 | xor                 ebx, ebx
            //   c744241410590110     | mov                 dword ptr [esp + 0x14], 0x10015910
            //   8d6f08               | lea                 ebp, [edi + 8]
            //   3beb                 | cmp                 ebp, ebx

        $sequence_9 = { c644242d73 c644242e67 c644242f57 c644243061 c644243169 884c2432 c644243346 }
            // n = 7, score = 100
            //   c644242d73           | mov                 byte ptr [esp + 0x2d], 0x73
            //   c644242e67           | mov                 byte ptr [esp + 0x2e], 0x67
            //   c644242f57           | mov                 byte ptr [esp + 0x2f], 0x57
            //   c644243061           | mov                 byte ptr [esp + 0x30], 0x61
            //   c644243169           | mov                 byte ptr [esp + 0x31], 0x69
            //   884c2432             | mov                 byte ptr [esp + 0x32], cl
            //   c644243346           | mov                 byte ptr [esp + 0x33], 0x46

    condition:
        7 of them and filesize < 1138688
}
Download all Yara Rules