MalwareUsed by 2 actors

Denis

Denis is a Windows backdoor associated with APT32, also known as OceanLotus. It enables remote control of compromised computers and has variants implemented in PowerShell and deployed as memory-resident shellcode. Its discovery functions collect the victim's username and local IP address and query Windows Registry keys and values. It also supports commands to delete files. Denis Base64-encodes data sent to its command-and-control server and decrypts strings used for command-and-control communication during execution.

Denis uses process hollowing, dynamic Windows API resolution, and anti-debugging checks to hinder analysis and conceal execution. It has been loaded through DLL side-loading involving legitimate applications, including WPS word-processing software and Adobe 3D Utility. An observed OceanLotus deployment used a Vietnamese-language environmental-themed archive containing images and a malicious HTA script. The script decrypted an embedded loader and executed shellcode in memory, leading to a staged installation that launched Denis through side-loaded DLLs. This deployment established persistence through a Registry autorun entry and used host-derived installation names, execution-flow obfuscation, and inflated files to impede detection and analysis.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

APT32

The loaded shellcode is a variant of the Denis family used by OceanLotus.

via qianxin ti centerti.qianxin.com

海莲花

其中通过利用WPS 文字处理软件的白利用方式加载恶意DLL 文件，并用于最终加载执行海莲花特有的Denis 木马。

via qianxin ti centerti.qianxin.com

MITRE ATT&CK

Techniques & procedures

22 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

5 techniques

T1059.001PowerShellEvidence4

The content repeatedly describes threat actors and malware using PowerShell to execute payloads, run commands, download additional malware, perform lateral movement, evade defenses, and execute scripts in memory. | Examples include: 'APT28 downloads and executes PowerShell scripts and performs PowerShell commands'; 'APT3 has used PowerShell on victim systems to download and run payloads after exploitation'; 'TA505 has used PowerShell to download and execute malware and reconnaissance scripts.'

T1059.003Windows Command ShellEvidence3

Numerous entries state malware can create a remote shell or reverse shell, for example 4H RAT, BLACKCOFFEE, DarkComet, PlugX, QuasarRAT, and others. | The content repeatedly describes threat actors and malware using cmd.exe, the Windows command shell, to execute commands, launch payloads, run batch files, and automate actions on compromised hosts.

T1106Native APIEvidence3

The content is a MITRE ATT&CK-style listing of many malware families and threat groups using Windows/native OS APIs for execution, injection, discovery, anti-debugging, and other actions, ending with 'NtCreateProcess' and 'fork()'.

T1574Hijack Execution FlowEvidence2

T1574.001DLLEvidence2

Privilege Escalation

1 technique

T1055.012Process HollowingEvidence2

Stealth

9 techniques

T1027Obfuscated Files or InformationEvidence2

T1027.010Command ObfuscationEvidence2

T1055.012Process HollowingEvidence2

T1070.004File DeletionEvidence2

T1140Deobfuscate/Decode Files or InformationEvidence3

The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.

T1497.001System ChecksEvidence2

T1574Hijack Execution FlowEvidence2

T1574.001DLLEvidence2

T1622Debugger EvasionEvidence1

Denis used the IsDebuggerPresent, OutputDebugString, and SetLastError APIs to avoid debugging. Dridex has used the OutputDebugStringW function to avoid malware analysis as part of its anti-debugging technique.

Discovery

7 techniques

T1012Query RegistryEvidence2

T1016System Network Configuration DiscoveryEvidence2

T1033System Owner/User DiscoveryEvidence3

The content repeatedly describes malware and threat actors collecting the victim username, identifying logged-in users, running whoami, query user, quser, or similar commands to determine the current user or user sessions.

T1082System Information DiscoveryEvidence3

The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.

T1083File and Directory DiscoveryEvidence2

T1497.001System ChecksEvidence2

T1622Debugger EvasionEvidence1

Collection

1 technique

T1560.002Archive via LibraryEvidence2

Command and Control

4 techniques

T1071.004DNSEvidence2

T1105Ingress Tool TransferEvidence3

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."

T1132Data EncodingEvidence1

ADVSTORESHELL C2 traffic is encrypted, then encoded with Base64 encoding. APT19 HTTP malware variant used Base64 to encode communications to the C2 server. APT33 has used base64 to encode command and control traffic.

T1132.001Standard EncodingEvidence2

INDICATORS OF COMPROMISE

IOCs tracked for this family

3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

1 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

2 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app7 years ago

domain●●●●●●●●●●●●View more in app7 years ago

ACTIVITY FEED

Recent activity

44 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

44 SOURCESView more in app

eset welivesecurity blogNews

Jun 11, 2026

OceanLotus: From external espionage to domestic targeting

Backdoor used by OceanLotus that implements DNS tunneling for command-and-control communications.

mitre attack websiteNews

Oct 25, 2022

System Owner/User Discovery, Technique T1033 - Enterprise | MITRE ATT&CK®

Trojan that enumerates and collects the username from the victim machine.

mitre attack websiteNews

Apr 25, 2022

Command and Scripting Interpreter: PowerShell, Sub-technique T1059.001 - Enterprise | MITRE ATT&CK®

Malware with a PowerShell-based variant.

mitre attack websiteNews

Apr 25, 2022

System Network Configuration Discovery, Technique T1016 - Enterprise | MITRE ATT&CK®

Uses ipconfig to gather system IP addresses.

+40 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching3

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping22

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Denis