SilverFox

SilverFox is a Windows malware cluster labeled by OpenCTI and MalwareBazaar. Static analysis reveals two distinct build variants: a larger Rust dropper (ed1a00479fe2) and a lean C stub (82d425516199) — both share identical stream-cipher constants, XOR-thunk API dispatch, resource-extraction logic, and process-hollowing behaviour, confirming they belong to the same family. Co-tagged valleyrat.

Overview

Build Stack

Two observed variants share the same runtime behaviour but diverge in compilation and packing layers:

Rust variant (ed1a00479fe2)

• Compiler: rustc via x86_64-pc-windows-msvc target (MSVC 14.0 linker).^[pefile.txt:45]
• Stripping: Full strip (external PDB reference).^[pefile.txt:39]
• Sections: .text, .rdata, .buildid (Rust artifact), .data, .pdata, .tls, .rsrc, .reloc.^[pefile.txt:75]

C variant (82d425516199)

• Compiler: C (rabin2 lang: c, no .buildid).^[rabin2-info.txt:17]
• Linker: MSVC 6.0 (anachronistic for 2026 — possibly fabricated or legacy toolchain).^[pefile.txt:45]
• Sections: .text, .rdata, .data, .pdata, .rsrc (5 sections).^[pefile.txt:75]
• Size: 50 176 bytes (~one-third the Rust sibling).^[triage.json]
• Thunk dispatch: Every API call indirected through a single XOR-decrypt thunk (fcn.0040789c in r2; >222 call sites).^[r2:fcn.0040789c]
• API resolution: FNV-1a 64-bit hash resolver (basis 0xcbf29ce484222325, prime 0x100000001b3).^[r2:fcn.00407790]

Shared across both variants

• VersionInfo: Randomized per build (e.g. JUjflFmsWFlu.exe, CHuWqU, KDePSx.exe).^[pefile.txt:321]
• Stream-cipher constants: 0xcaaafe23, 0x3d57aa23, 0x44d9bb23, 0x9e37cb23.^[r2:fcn.00402e77]

Deploy / TTPs

Variants / Aliases

• OpenCTI/MalwareBazaar: silverfox, valleyrat, trojan/silverfox.bg[qtsc]
• Relationship to ValleyRAT is unconfirmed at this depth — may be shared infrastructure, dual labeling, or a fork.

Capabilities

• resource-embedded-payload-extraction
• custom-stream-cipher-payload-decryption
• lzss-payload-decompression
• ntdll-text-unhook-from-disk (Rust variant only)
• CreateRemoteThread-alternative-injection
• suspended-child-process-hollowing
• SeDebugPrivilege-elevation
• self-delete-delayed-until-reboot
• runtime-api-resolution
• xor-thunk-api-dispatch (C variant; >222 call sites via single decrypt thunk)
• fnv1a-64-api-resolution (C variant; basis 0xcbf29ce484222325)
• environment-gate-sandbox-evasion
• version-info-masquerade
• NtQuerySystemInformation-module-enumeration
• standard-iat-low-obfuscation
• lzss-in-memory-payload-staging
• ShellExecuteExW-fallback-execution

C stub variant (e772de93) — NEW

• Masquerade: Sangfor Technologies Inc. / Sangfor Defender Antivirus Client UI / sfavui.exe^[pefile.txt:261-268]; dual VS_VERSIONINFO (EN-US + ZH-CN); 32 dual-language RT_ICON entries^[pefile.txt:445-1112]
• Social engineering: Filename 2026.05.21裁员名单及补偿方案WPS.exe (Chinese staff list + severance compensation lure)^[triage.json]
• Certificate: Authenticode PKCS#7 blob present (Microsoft Windows / Windows Production PCA 2011 chain)^[strings.txt:384-481]; signature validity unverified
• Sandbox gate: argc <= 1 early exit^[r2:entry0]
• API dispatch: XOR-thunk via DAT_xxxx ^ _DAT_00408000, 50-entry in-place decryption table^[ghidra:FUN_0040577e]

RC4 loader variant (139329dc9) — NEW

• Compiler: MSVC 14.16 (C/C++).^[pefile.txt:49]
• Linker: MSVC 2017/2019 (not 6.0, not Rust).^[exiftool.json:18]
• Size: 173 056 bytes (~3.4× the C stub, ~1.1× the Rust sibling).^[triage.json]
• Packing/encryption: Standard RC4 (not custom stream cipher) using a 28-byte key derived from XOR-obfuscated API strings; in-place section decryption of .text (0x22C00 bytes, entropy 7.998), .data, and import table.^[pefile.txt:95, r2:fcn.14002b8a0, r2:fcn.14002b360, r2:fcn.14002b470]
• API resolution: PEB-walking (gs:[0x60]) to locate ntdll.dll, then export-table traversal to resolve LoadLibraryA, GetProcAddress, and VirtualProtect. No static imports used by the stub.^[r2:fcn.14002b5c0, ghidra:FUN_14002b5c0]
• Anti-signature: All nine section names are null-filled; checksum is zeroed; LOAD_CONFIG and debug directories contain fabricated future-dated garbage.^[pefile.txt:80,424,480]
• Payload clues: Strings Stub.dll and g_stcParam in the decryptor suggest a reflective DLL payload.^[strings.txt:439-440]
• Social engineering: Chinese-language filename masquerading as an internal staff disciplinary list.^[triage.json]

C x64 Authenticode IAT variant (beb3a9d9) — NEW

• Compiler: MSVC 14.0 (C).^[pefile.txt:45,exiftool.json:18]
• Linker: MSVC 2015/2017 (not 6.0, not Rust).^[exiftool.json:18]
• Size: 104 208 bytes (~medium weight between the 50K FNV-1a stub and the 173K RC4 loader).^[triage.json]
• Packing/encryption: LZSS-compressed payload embedded directly in .rdata (no .rsrc section at all).^[pefile.txt:98-115]
• API resolution: Standard IAT imports from KERNEL32, ntdll, ADVAPI32, SHELL32, PSAPI — not zero-IAT or PEB-walking.^[pefile.txt:268-361]
• Signing: Authenticode PKCS#7 blob present (Microsoft Windows / Windows Production PCA 2011 chain).^[binwalk.txt:4-9]
• Sandbox evasion: CreateToolhelp32Snapshot process enumeration with Sleep(1000) retry loops; anti-VM/AV process name checks via lstrcmpiW.^[r2:fcn.140001030]
• Payload delivery: LZSS decompression via fcn.140004000 (12-bit window, SSE-accelerated copies) → NtAllocateVirtualMemory + NtWriteVirtualMemory into a suspended child created by CreateProcessW.^[r2:fcn.140001030,r2:fcn.140004000]
• Self-deletion: Imports MoveFileExW^[pefile.txt:302]; sibling behavior strongly suggests MOVEFILE_DELAY_UNTIL_REBOOT use.
• Social engineering: Chinese-language filename (2026.05.22裁员名单及补偿方案WPS.exe — staff-reduction list + severance compensation lure).^[metadata.json:4,triage.json:5]

DLL side-loader variant (17d6415d) — NEW

• Compiler: MSVC 14.16 (C/C++), MSVC 2017/2019.^[pefile.txt:45,exiftool.json:18]
• Format: PE32+ x64 DLL (not EXE).^[file.txt]
• Size: 104 448 bytes.^[triage.json]
• Masquerade: Exports 23 fake WavesFX_* functions pretending to be MaxxAudioAPOShell64.dll; VersionInfo claims libcurl.dll / Daniel Stenberg.^[strings.txt:260-283,exiftool.json:36-43]
• No embedded payload: No LZSS, no stream cipher, no RC4. Expects a companion payload DLL in %LOCALAPPDATA%\Microsoft\.^[r2:fcn.180001000]
• Anti-VM gates: (1) SLIsGenuineLocal via Slwga.dll; (2) process enumeration for CExecSvc; (3) network-adapter check for mshome.net DNS suffix; (4) RunOnce registry enumeration.^[r2:fcn.1800021a0,r2:fcn.180002380,r2:fcn.180002630,r2:fcn.180001f20]
• String obfuscation: Single-byte XOR with key 0x5d on all UTF-16LE strings.^[r2:fcn.1800021a0:0x18000227e]
• Installer behaviour: Copies self to %LOCALAPPDATA%\Microsoft\, enumerates .dll files, spawns suspended child via CreateProcessW.^[r2:fcn.180001000]
• Self-deletion: Not observed; no MoveFileExW import. Relies on RunOnce persistence instead.
• Family confidence: Medium — co-labeled silverfox/valleyrat by OpenCTI, but build diverges significantly from cluster norms (no LZSS, no hollowing, no embedded payload).

.NET Native AOT variant (fbc07658) — NEW

• Compiler: .NET Native AOT (ILC), MSVC 14.51 linker.^[rabin2-info.txt:11] ^[exiftool.json:18]
• Format: PE32+ x64 console executable (not DLL).^[file.txt]
• Size: 10 083 840 bytes (~10 MB).^[triage.json]
• Build provenance: PDB path C:\Users\52pojie\Desktop\420\bin\Debug\net10.0\win-x64\native\Update.pdb — Chinese cracking forum 52pojie origin.^[rabin2-info.txt:13]
• Masquerade: VersionInfo claims Update / Update.dll / 1.0.0.0.^[exiftool.json:36-42]
• No embedded payload: No LZSS, no RC4, no stream cipher, no process hollowing. Static analysis reveals only the BCL networking/crypto stack and standard Win32 APIs.
• Exports: 39 — dominated by Brotli compression APIs (BrotliDecoderCreateInstance, BrotliEncoderCompress, etc.) plus DotNetRuntimeDebugHeader.^[pefile.txt:318-358]
• Networking: System.Net.Http, System.Net.Sockets, WS2_32.dll (WSAConnect, WSARecv, WSASend).^[strings.txt:2217-2226] ^[pefile.txt:369-435]
• Cryptography: System.Security.Cryptography, bcrypt, crypt32, CryptProtectMemory.^[strings.txt:2224,2382,2383] ^[pefile.txt:369-435]
• Anti-analysis: Native AOT compilation removes all CLR metadata, defeating dnSpy/ILSpy and conventional .NET packer detection. No section encryption or packing; threat actor relies on AOT opacity.^[binwalk.txt] ^[pefile.txt:92,112]
• Family confidence: Low — co-labeled valleyrat/silverfox by OpenCTI, but build stack (.NET Native AOT, 52pojie provenance, 10 MB BCL bloat) is completely orthogonal to every other SilverFox variant. Treat as a distinct build pipeline at minimum.

AV Teardown Driver-Dropper variant (1290bdba) — NEW

• Compiler: MSVC 14.30 (Visual Studio 2022), C/C++.^[pefile.txt:49]
• Linker: MSVC 14.30 (not 6.0, not Rust, not .NET).^[pefile.txt:49]
• Size: 659 456 bytes (~659 KB).^[triage.json]
• Packing / encryption: None. Plaintext IAT, no section encryption, no PEB-walking.^[pefile.txt:292-460]
• Anti-analysis: Absent. No debugger checks, no VM gates, no sandbox evasion. Relies on driver + IFEO for runtime defense evasion.
• Driver payload: Bundled kernel driver encrypted with RC4 (key LordROmAn$) + XOR, decoded GUID blocks (0xb529/0x9e37 multiplier), dropped to disk and loaded via NtLoadDriver.^[strings.txt:453,10308]^[r2:fcn.140005090]
• AV teardown: IFEO offline hive manipulation — saves IFEO hive, modifies Debugger → systray.exe for MpDefenderCoreService.exe, SecurityHealthService.exe, SecurityHealthSystray.exe, then restores hive.^[strings.txt:10258]^[strings.txt:10261-10265]
• Privilege escalation: SeLoadDriverPrivilege enablement via LookupPrivilegeValueW/AdjustTokenPrivileges; UAC bypass via ShellExecuteExW with runas verb.^[strings.txt:10296]^[r2:fcn.140006a60]
• Service disable: ChangeServiceConfigW / ChangeServiceConfig2W plus registry Start=4 to permanently disable AV services.^[strings.txt:10276]^[pefile.txt:421-422]
• Persistence: Appends payload path to Userinit registry value.^[strings.txt:10354]
• Self-cleanup: Unloads driver via NtUnloadDriver, deletes dropped driver file.^[strings.txt:10347-10348]
• Family confidence: High — co-tagged silverfox/valleyrat; new build pipeline (MSVC 14.30, LordROmAn$ key) but consistent with Chinese-language SilverFox cluster.

Notable Analyses

• ed1a00479fe2ea2555882c67719abc86e98b512f122aea79adacf37355cab996 — Rust x64 dropper with LZSS + stream cipher, ntdll unhooking, process hollowing.
• 82d425516199d497c3a25edc4c3ad05c14469f697230f3ad17fe03ce73cd0216 — C x64 lean stub (50K) sharing same stream-cipher constants and thunk dispatch; uses FNV-1a API resolution and argc == 1 sandbox gate.
• 139329dc9992e132f9c8d887ad685660161cefcfb0a18867d616a7d217a0605e — MSVC C++ x64 RC4 loader with zero section names, PEB-walking API resolution, and reflective DLL delivery.
• e772de930167a24868814510021d73d8c061b4d7af0946ac302e53bb1c9cba56 — C x64 stub (~374 KB) with Sangfor EDR masquerade, dual-language .rsrc icon set, Authenticode signature, and XOR-thunk dispatch.
• beb3a9d9fa738ac7ebac7dc8f5357c9a6673cfae1bc50fd73497d350afd5ed1c — C x64 Authenticode-signed sibling with LZSS .rdata payload, standard IAT, process enumeration, and sleep-loop sandbox evasion.
• 452e085f42d6054435f95d363588f3d516f1a52d28b033f33a91e843ac4d720e — C++ x64 injector (228 KB) using standard IAT, LZSS decompressor at FUN_140004000, dual token escalators (FUN_1400038c0 / FUN_140003f80), VirtualAllocEx/NtWriteVirtualMemory hollowing, ShellExecuteExW fallback, and MoveFileExW self-delete. Unsigned; no anti-debug. Static-only.
• 17d6415df0d336e255df7689ae90039e48fd6e95d43fbbc34d5b4875ea9af47d — DLL side-loader masquerading as MaxxAudioAPOShell64.dll with fake WavesFX exports, WGA validation, CExecSvc container detection, mshome.net NAT check, and %LOCALAPPDATA%\Microsoft\ self-staging. No embedded payload; expects external companion DLL.
• fbc07658954f87579d615e72f76335f6fae5cec34a283535a37f72d6a4abce15 — .NET Native AOT console binary (Update.dll masquerade, 10 MB) with 52pojie build provenance, Brotli exports, full BCL networking/crypto stack. No embedded payload, no process hollowing, no LZSS. Static-only.
• 1290bdba07eb77310f187c0392c5c9469ad2ad74baec9815b033ce99c445daaa — MSVC 14.30 x64 AV teardown driver-dropper. RC4+XOR embedded driver (key LordROmAn$), IFEO offline hive paralyze, NtLoadDriver privilege escalation, Userinit persistence, service disable via Start=4. No anti-analysis; static-only.

Capabilities

• resource-embedded-payload-extraction
• custom-stream-cipher-payload-decryption
• lzss-payload-decompression
• rc4-section-decryption
• ntdll-text-unhook-from-disk (Rust variant only)
• CreateRemoteThread-alternative-injection
• suspended-child-process-hollowing
• SeDebugPrivilege-elevation
• self-delete-delayed-until-reboot
• runtime-api-resolution
• xor-thunk-api-dispatch (C variant; >222 call sites via single decrypt thunk)
• fnv1a-64-api-resolution (C variant; basis 0xcbf29ce484222325)
• environment-gate-sandbox-evasion
• peb-walking-api-resolution (RC4 loader variant)
• rc4-in-place-section-decryption (RC4 loader variant)
• zero-section-name-anti-signature (RC4 loader variant)
• reflective-dll-stub-delivery (RC4 loader variant; Stub.dll + g_stcParam)
• lzss-rdata-payload-embedding (Authenticode C variant)
• Authenticode-signature-masquerade
• process-enumeration-anti-vm-gate
• sleep-loop-sandbox-evasion
• standard-iat-resolution-low-obfuscation
• dll-side-loading-masquerade (DLL variant; fake WavesFX exports)
• xor-0x5d-string-obfuscation (DLL variant; single-byte XOR on UTF-16LE)
• wga-validation-gate (DLL variant; SLIsGenuineLocal)
• container-service-detection (DLL variant; CExecSvc process check)
• vm-nat-network-detection (DLL variant; mshome.net DNS suffix check)
• runonce-registry-enumeration (DLL variant)
• appdata-self-staging (DLL variant; %LOCALAPPDATA%\Microsoft\)
• suspended-child-spawn (DLL variant; CreateProcessW with empty command line)
• rc4-xor-double-stage-driver-decryption (MSVC 14.30 variant; key LordROmAn$)
• ifeo-offline-hive-paralyze (MSVC 14.30 variant; Debugger → systray.exe)
• service-start-type-disable (MSVC 14.30 variant; Start=4 via ChangeServiceConfigW)
• userinit-registry-persistence (MSVC 14.30 variant)
• ntloaddriver-privilege-escalation (MSVC 14.30 variant; SeLoadDriverPrivilege)
• sebackup-serestore-hive-manipulation (MSVC 14.30 variant)
• guid-block-decoding (MSVC 14.30 variant; 0xb529/0x9e37 multiplier)
• runas-verb-uac-bypass (MSVC 14.30 variant; ShellExecuteExW)
• driver-self-cleanup (MSVC 14.30 variant; NtUnloadDriver + file delete)

Related Entities

• No confirmed linked families yet.
• Related technique: peb-walking-api-resolution
• Related technique: rc4-in-place-section-decryption