RingQ

Samples

Recent samples

1 sandbox sample in the Derp library, newest 1 shown

43ee36f65b9770b2d4a9f5cf92501be04d6bbe308adbfdf2b8002fb9de4f796a

Analysed Oct 3, 2026Triage report

Reported operators

Threat actors

2 named in public reporting

Larva-26009

RingQ is a tool available on GitHub that reads an encrypted file located in the same Path, decrypts it, and executes it in memory.

Shadow-Earth-053

In one targeted environment, we detected a sample of RingQ, which is an open-source tool of Chinese origin available on GitHub that is designed to pack malicious binaries in order to evade detection by security solutions.

MITRE ATT&CK

RingQ in ATT&CK

6 distinct techniques

Techniques

6 techniques

T1090 Proxy T1055 Process Injection T1620 Reflective Code Loading T1140 Deobfuscate/Decode Files or Information T1027 Obfuscated Files or Information T1027.002 Software Packing

Reporting

Research mentioning RingQ

Jul 29

Malware News

Case Study: Targeted Attack Case on an MS-SQL Server Involving the Installation of GotoHTTP and SoftEther VPN - Malware Analysis - Malware Analysis, News and Indicators

A targeted attack on an MS-SQL server led to the deployment of XMRig CoinMiner along with multiple remote-access tools, according to AhnLab ASEC. The intrusion was attributed to the Larva-26009 threat actor, which went beyond the common pattern of opportunistic cryptomining on exposed SQL servers by also installing VShell, GotoHTTP, and SoftEther VPN to maintain control over the compromised system. The toolset indicates the attackers sought both monetization and persistent remote administration after the initial compromise. While coin miners are frequently observed in attacks against internet-exposed Microsoft SQL Server instances, the addition of tunneling and remote-management software suggests a more deliberate post-compromise operation designed to preserve access and expand attacker control over the victim environment.

Jul 24

Ahnlab Asec