Chinoxy | Netskope Threat Labs

Description

Chinoxy is a backdoor used since at least November 2018 to gain persistence and drop additional payloads during the FunnyDream campaign. Researchers attribute its use to Chinese-speaking threat actors.

Stats

First seen: September 2022
Last seen: September 2026

MITRE ATT&CK techniques

5 techniques across 2 tactics.

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
T1140Deobfuscate/Decode Files or Information
T1574Hijack Execution Flow
- T1574.001DLL

Associated campaigns

C0007FunnyDream

Alert name variants

Alert Name	Engine
Generic.Trojan.Chinoxy.5FC8A6D5	AV
Generic.Trojan.Chinoxy.A769C903	AV
Win32.Backdoor.Chinoxy	ATP Sandbox Adv. Heuristics
Win32.Trojan.Chinoxy	ATP Sandbox Adv. Heuristics

Related families

PlugX Metamorfo Bazar Bisonal DarkGate

References

attack.mitre.org
malpedia.caad.fkie.fraunhofer.de