Loading malware…
Chinotto is a malware family associated with the North Korean espionage actor APT37, also tracked as ScarCruft and Reaper. It has been used in long-running surveillance and data-theft operations targeting individuals and organizations of strategic interest to the DPRK, including North Korean defectors, journalists, human rights activists, and South Korean targets. Public reporting describes Chinotto as a cross-platform toolset with Windows, PowerShell-based, and Android implementations that share related command-and-control design patterns.
On Windows, Chinotto has been documented as a backdoor used for remote command execution, file upload and download, directory collection and archiving, screenshot capture, malware update, and persistence establishment. Variants have used HTTP-based tasking and exfiltration workflows, with some newer DLL forms focused heavily on data theft rather than interactive command retrieval. Reported Windows capabilities include collection of documents and other user files, removable-media harvesting, screenshot capture, and in some variants keylogging. Persistence has been observed through Run-key mechanisms and scheduled tasks, and delivery chains have frequently relied on script-based execution through MSHTA and PowerShell.
Android variants of Chinotto function as spyware. Reported capabilities include theft of contacts, SMS messages, call logs, account information, device metadata, photos, audio, and other files from external storage, as well as audio recording. The Android implants have been described as using a similar HTTP command-and-control model to the Windows family.
Chinotto has been delivered through multiple intrusion chains attributed to APT37. Observed vectors include spearphishing with malicious archives, CHM files, LNK shortcuts, macro-enabled Office documents, HWP documents, and XLL add-ins, often using decoy content themed around Korean political, social, or administrative topics. In several campaigns, lightweight PowerShell backdoors or loaders were used to fetch or execute later-stage Chinotto components.
The malware is primarily associated with cyberespionage and surveillance rather than disruption. Its role across campaigns has been to provide persistent access, remote control, and systematic exfiltration of victim data from both desktop and mobile environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
ASEC(AhnLab Security Emergengy response Center) 분석팀은 지난 1월 RedEyes 공격 그룹(also known as APT37, ScarCruft)이 한글 EPS(Encapulated PostScript) 취약점(CVE-2017-8291)을 통해 악성코드를 유포하는 정황을 확인하였다.
In 2020, the APT37 group has conducted attacks by embedding OLE objects in HWP document files and using them to trigger CVE-2018-15982, a vulnerability in Adobe Flash Player. | The final payload identified at this stage, "HncUpdate.exe", is a malicious file with information-stealing capabilities that was created on 2020-11-11 01:20:09 (UTC). It is widely known by the project name "Chinotto", based on the PDB path embedded in the file.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Chinotto Backdoor Technical Analysis of the APT Reaper’s Powerful Weapon ... Peeking at Reaper’s surveillance operations
또한, RedEyes 그룹은 PC 정보를 탈취하고 원격 제어를 수행하기 위해 파워쉘과 Chinotto 악성코드를 사용한다고 알려져 있다.
The campaign is attributed to ChinopuNK, a subgroup of ScarCruft tracked internally by S2W, which is known for distributing the Chinotto malware.
For years, the group relied on a malware family called Chinotto to carry out espionage and data theft.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
This registry key causes the HTML Application (HTA) file to get fetched and executed by the mshta.exe process every time the system is booted. The fetched ‘1.html’ is an HTML Application (.hta) file that contains Visual Basic Script (VBS), which eventually executes PowerShell commands.
a simple backdoor which communicates every 7 seconds to its C2 to receive a command to execute through cmd.exe /c [command]
This document contains a malicious macro and a payload for a multi-stage infection process. The first stage’s macro contains obfuscated strings and then spawns another macro as a second stage.
One of the characteristics of this malware is that it contains a lot of garbage code to impede analysis... It also restores functional strings such as C2 addresses and debugging messages to the stack at runtime.
The first stage macro contains obfuscated strings... If no Kaspersky security software is installed, the macro directly proceeds to decrypt the next stage’s payload.
In order to generate the identification value of the victim, the malware acquires both computer and user name and combines them in the format ‘%computer name%_%user name%’.
Granting these permissions allows the apps to collect sensitive information, including contacts, messages, call logs, device information and audio recordings.
Based on what we found from this victim, we can confirm that the malware operator collected screenshots and exfiltrated them between August 6, 2021 and September 8, 2021.
During our day to day hunting to protect our customers, we came across two Command and Control servers (C2s) of the North Korea-nexus intrusion set Reaper (aka APT37) with open directories...
The PowerShell script offers simple backdoor functionalities and continuously queries the C2 server with HTTP POST requests containing several parameters.
270 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A ScarCruft/APT37-linked backdoor/spyware family used for surveillance, including monitoring individuals’ daily lives and Android targeting.
Named as the final information-stealing payload in the campaign.
An APT37-associated malware family used historically for espionage and data theft.
PowerShell backdoor supporting file transfer and command execution, with persistence via registry and scheduled tasks; delivered via LNK/CHM/HTA/PowerShell chains.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.