Winos
Winos is a modular remote access Trojan associated with the Silver Fox malware ecosystem. In the provided reporting, it is described as one of the most common Trojans in the Silver Fox family and has been distributed in campaigns active since at least 2024, with Silver Fox activity dating to 2022. Observed delivery relied on phishing and social-engineering lures, including fake Adobe Flash updates and counterfeit software download pages impersonating Google Translate, WPS, currency converters, Easy Translation, Youdao Translation, Bit Browser, and LetsVPN. The campaign used MSI and EXE installer packages, both of which ultimately deployed Winos.
In the analyzed MSI infection chain, the installer loaded aicustact.dll, which was used to load attacker-specified files listed in the MSI Property table. An update.bat script executed a legitimate installation program while also launching a malicious payload. A javaw.exe component established persistence by writing Microsoftdata.exe into the Windows Run registry. Microsoftdata.exe, a Golang binary named to resemble legitimate software, then read Xps.dtd from the same directory; decrypted shellcode from Xps.dtd loaded an embedded PE and transferred execution to its exported run function. Although the final PE contained the PDB string "RexRat4.0.3," researchers assessed the core malware as Winos.
Documented Winos capabilities include modular plug-in support for remote control and data theft, specifically screenshot capture, keylogging, and clipboard theft. The reporting also states that leaked source code such as Winos 4.0 enabled broader reuse and redevelopment by multiple cybercrime groups and some APT actors, including Golden Eye Dog. The malware has been spread through email, phishing websites, instant messaging software, counterfeit software download pages, and SEO-optimized malicious sites. Reported infrastructure associated with the campaign included phishing infrastructure at 192.252.181[.]55 and www.ggfanyi[.]com, and C2 endpoints at 8.218.115.90:8080, 8.218.115.90:8081, 154.91.66.58:8088, 154.91.66.58:8089, 103.116.246.234:6234, 43.250.174.49:1989, 154.222.24.214:886, 154.222.24.214:668, 206.119.167.191:8003, 206.119.167.191:8004, 1.94.163.46:666, 203.160.55.201:1860, 154.94.232.242:8888, and 154.94.232.242:6666.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Techniques & procedures
16 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
1 technique
Reconnaissance
Resource Development
1 technique
Resource Development
Initial Access
5 techniques
Initial Access
When they detect a user clicking anywhere on the page, a prompt indicating an outdated Flash version appears, ultimately redirecting the page to the attacker’s designated download page.
MITRE ATT&CK Mapping Tactic Technique ID Notes Initial Access Supply Chain Compromise T1195.002 Trojanized Chinese software distribution
Since 2022, the Silver Fox cybercrime gang has been active, typically using multiple channels such as email, phishing websites, and instant messaging software to widely spread Trojan viruses.
Execution
2 techniques
Execution
Persistence
1 technique
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
2 techniques
Stealth
Credential Access
1 technique
Credential Access
Collection
3 techniques
Collection
As one of the most common Trojans of the Silver Fox family, winos has a rich set of functional plug-ins that enable various remote control functions and data theft on the target host, such as: Keyboard log
IOCs tracked for this family
81 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware family referenced in SEO poisoning/GitHub Pages distribution campaigns targeting Chinese-speaking users; no further details in excerpt.
Remote access trojan with a rich set of plug-ins for remote control and data theft, widely redeveloped by cybercrime and APT groups.
A core Silver Fox family Trojan/RAT delivered by MSI and EXE installers. It establishes persistence via registry run keys and provides plugin-based remote control and data theft capabilities including screenshots, keylogging, and clipboard theft.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.