Chrysalis
- First seen
- 2022-04-15 00:00:00
- Malware type
- backdoor, loader
- Family
- Malware family
- Profile updated
- 2026-07-07 14:52:42
Targeted industries: government-and-public-sector technology-and-telecommunications defense-and-aerospace
Context
According to Rapid7, Chrysalis is a custom, feature-rich backdoor. Its wide array of capabilities indicates it is a sophisticated and permanent tool, not a simple throwaway utility. It uses legitimate binaries to sideload a crafted DLL with a generic name, which makes simple filename-based detection unreliable. It relies on custom API hashing in both the loader and the main module, each with its own resolution logic. This is paired with layered obfuscation and a fairly structured approach to C2 communication.
Detection coverage
- 4 YARA rules
Detection rules
- MALPEDIA_Win_Chrysalis_Auto (yara-rule)
- SIGNATURE_BASE_MAL_Chrysalis_Dllloader_Feb26 (yara-rule)
- SIGNATURE_BASE_MAL_Chrysalis_Shellcode_Loader_Feb26 (yara-rule)
- SIGNATURE_BASE_MAL_Chrysalis_Backdoor_Feb26 (yara-rule)
Reports & references
- malpedia.caad.fkie.fraunhofer.de — Win.Chrysalis (report)
- Kaspersky — 118708 (report)
- rapid7.com — Tr Chrysalis Backdoor Dive Into Lotus Blossoms Toolkit (report)