Trochilus
Trochilus is an open-source Windows remote access trojan (RAT), first observed in 2015, implemented in C++ and publicly available on GitHub. It is used directly as a backdoor and has also served as the code base for other malware, with multiple reports noting substantial source-code overlap between Trochilus and RedLeaves, and that SprySOCKS is based on Trochilus. Trochilus has been associated in reporting with several China-linked espionage clusters and campaigns, including APT31, Webworm, FishMonger/Earth Lusca, STONE PANDA-related activity, and UNC3569 operations distributing a customized Trochilus payload.
Documented capabilities include remote administration functions such as downloading, uploading, and executing files. In observed customized deployments, Trochilus variants were unpacked and executed in memory, injected into processes such as svchost.exe, and loaded compressed configuration data from paths including C:\ProgramData\Logger\sc.cfg, C:\ProgramData\resmon.resmoncfg, and C:\ProgramData\appsoft\resmon.resmoncfg. Symantec reported a Webworm deployment chain in which a legitimate executable (Logger.exe) loaded a malicious DLL (logexts.dll), which executed staged shellcode and ultimately launched a modified Trochilus payload in memory; associated files included sc.cfg, logexts.dat, logexts.dll, and logger.dat under TEMP and C:\ProgramData\Logger. In another reported case, a scenario used vtcp.dll from the Trochilus RAT collection. UNC3569-linked activity included a DOUBLESTEP dropper delivered from an Aliyun OSS URL that embedded a customized Trochilus backdoor encrypted with RC4 key a3s1df3a1sd3ad18a0s8daf0; the sample Ssl-update.exe had MD5 5f7764e2c6fd2185f4df9fb2873f1fe8.
Trochilus has appeared in targeted intrusions against government and enterprise victims, including telecom and think tank targets in reporting on APT31, and in Webworm operations against government agencies and enterprises in IT services, aerospace, and electric power sectors across Russia, Georgia, Mongolia, and other Asian countries. High-confidence indicators directly mentioned in the content include the modified Trochilus payload hash e69177e58b65dd21e0bbe4f6caf66604f120e0c835f3ee0d16a45858f5fe9d90, the Aliyun OSS delivery URL hosting Ssl-update.exe, and the configuration file paths noted above.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
SprySOCKS is based on a Windows remote access trojan called Trochilus, and shares several common traits with RedLeaves, a backdoor that also exhibits extensive source code overlaps with Trochilus.
First spotted back in 2015, Trochilus is a RAT implemented in C++ and its source code is available for download on GitHub. ... Then the file unpacks and executes in memory its backdoor payload, a variant of the Trochilus RAT.
The URL https://chuanqiliebiao-1314[.]oss-cn-shanghai[.]aliyuncs[.]com/wp-content/plugins/Ssl-update.exe will download a dropper ... dubbed ‘DOUBLESTEP’ ... embedded with TROCHILUS.
Baobeilong (宝贝龙/”Baby Dragon”) also maintained a GitHub account that had forked both the Quasar and Trochilus RATs, two open-source tools historically used by STONE PANDA
Tooling-wise, APT31 initially used a number of malware families (RAWDOOR, Trochilus, EvilOSX, DropDoor/DropCat, etc.)...
Techniques & procedures
5 distinct techniques documented for this family, organized by ATT&CK tactic.
Execution
1 technique
Execution
Baobeilong (宝贝龙/”Baby Dragon”) also maintained a GitHub account that had forked both the Quasar and Trochilus RATs, two open-source tools historically used by STONE PANDA... Falcon Intelligence recently independently conducted detailed analysis of the RedLeaves malware... found it was directly sourced from Trochilus code
Stealth
2 techniques
Stealth
To cover the malicious traffic, the attackers registered C2 domains masquerading as normal AWS or AlibabaCloud domains... This cluster of activity has previously targeted entities... using malicious domains that masquerade as services such as Amazon Web Services and Microsoft Support Services.
Command and Control
2 techniques
Command and Control
Recent activity
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Windows remote access trojan that served as the basis for SprySOCKS and has source code overlaps with RedLeaves.
An open-source Windows RAT whose codebase was used as the basis for SprySOCKS.
Previously used backdoor associated with Webworm prior to adoption of newer stealthier malware.
Established remote access trojan/backdoor previously used by Webworm in earlier operations.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.