Malware

TONESHELL

Indicators of Compromise 10

Filename cert.ini Filename defender.exe Filename libngs.dll Filename loadcert.ini Filename msagent.sys Filename synchost.exe MD5 2d7c8780e97409770a9d4f31c66c9d63 MD5 9460e150e1981d5c165043520c5c12fe MD5 9717f005c5fb98e08d2ad983d88f94ee MD5 f518d8e5fe70d9090f6280c68a95998f

MITRE ATT&CK TTPs 9

T1003
OS Credential Dumping
Credential Access
 T1036
Masquerading
Defense Evasion
 T1053
Scheduled Task/Job
Execution
 T1055
Process Injection
Defense Evasion
 T1059
Command and Scripting Interpreter
Execution
 T1068
Exploitation for Privilege Escalation
Privilege Escalation
 T1071
Application Layer Protocol
Command And Control
 T1082
System Information Discovery
Discovery
 T1134
Access Token Manipulation
Defense Evasion

Source Articles

Mustang Panda Adds Signed Windows Rootkit to CoolClient Backdoor for Stealth
The threat actor Mustang Panda, also known as HoneyMyte, has updated its CoolClient backdoor with a signed Windows kernel-mode rootkit to enhance stealth. The rootkit, deployed as msagent.sys, is digitally signed with a certificate from Nanjing Ranyi Technology Co., Ltd. and enables hiding of malicious processes, files, registry entries, and C2 network activity. The malware is typically deployed after initial compromise via PlugX and uses DLL sideloading through a legitimate Sangfor executable to execute malicious components and establish persistence.
hacker-news ·3d ago