Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Delivery of this Chinad malware executable has been observed via FTP and after successful exploitation of CVE-2014-6332 in Microsoft Internet Explorer. | The malware, which has been identified by many vendors on VirusTotal, has been labeled by our researchers as Trojan.Chinad or just “Chinad” as an alternative (short) label.
Pic.jpg will then attempt to exploit the TS WebProxy component of Microsoft Windows, a vulnerability documented as CVE-2015-0016. This privilege escalation attack allows an attacker to launch an arbitrary process. | The malware, which has been identified by many vendors on VirusTotal, has been labeled by our researchers as Trojan.Chinad or just “Chinad” as an alternative (short) label.
14 distinct techniques documented for this family, organized by ATT&CK tactic.
It remains persistent on the victim’s system using either a traditional “runkey” registry method or by using the Windows task scheduler... schtasks.exe /create /F /sc onstart /tn MicrosoftWindowsShellInit /tr C:\Windows\SystemInit\wininit.exe /ru system
In this case, pic.jpg executes a powershell command in a hidden window... The decompressed script contains shellcode... and executed as a thread.
Delivery of this Chinad malware executable has been observed via FTP and after successful exploitation of CVE-2014-6332 in Microsoft Internet Explorer.
First, Uac_bypass.dll will make a copy of itself in the temp directory called NTWDBLIB.dll... The purpose of this is to use this cabinet along with wusa.exe to update the NTWDBLIB.dll... thereby hijacking the Dll. ... Then, Uac_Bypass.dll executes cliconfig.exe, which loads the new, malicious NTWDBLIB.dll into memory
It remains persistent on the victim’s system using either a traditional “runkey” registry method or by using the Windows task scheduler... schtasks.exe /create /F /sc onstart /tn MicrosoftWindowsShellInit /tr C:\Windows\SystemInit\wininit.exe /ru system
It remains persistent on the victim’s system using either a traditional “runkey” registry method or by using the Windows task scheduler... schtasks.exe /create /F /sc onstart /tn MicrosoftWindowsShellInit /tr C:\Windows\SystemInit\wininit.exe /ru system
shellcode_exec - Create a suspended process and inject shellcode into it. Then, resume the process.
Pic.jpg will then attempt to exploit the TS WebProxy component of Microsoft Windows, a vulnerability documented as CVE-2015-0016. This privilege escalation attack... allows an attacker to launch an arbitrary process.
shellcode_exec - Create a suspended process and inject shellcode into it. Then, resume the process.
First, Uac_bypass.dll will make a copy of itself in the temp directory called NTWDBLIB.dll... The purpose of this is to use this cabinet along with wusa.exe to update the NTWDBLIB.dll... thereby hijacking the Dll. ... Then, Uac_Bypass.dll executes cliconfig.exe, which loads the new, malicious NTWDBLIB.dll into memory
15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.