Loading malware…
9002 is a Windows remote access Trojan used in targeted cyberespionage operations. It has been deployed in the Sunshop campaign and is included in the toolsets associated with PKPLUG and BRONZE UNION, also known as APT27. Its modular variant, 3102, has been used against U.S. government targets and a European media organization. Shared infrastructure, signing certificates, and development artifacts connect 9002 to multiple intrusion clusters, but these overlaps do not establish a single operator for every deployment.
Delivery methods include spearphishing attachments, strategic website compromises, and payload hosting on Google Drive. Sunshop attacks installed 9002 through exploitation of Internet Explorer vulnerability CVE-2013-1347 and Java vulnerabilities CVE-2013-2423 and CVE-2013-1493. A 2017 spearphishing campaign used a Game of Thrones-themed Word document containing an embedded shortcut that launched PowerShell, downloaded encoded payloads, and injected 9002 shellcode into a legitimate Windows process. A startup shortcut maintained persistence by repeating the decoding and injection sequence.
Observed variants communicate over HTTP and a custom protocol that imitates TLS handshakes, using XOR-based encoding and Base64 to obscure command-and-control traffic. The 3102 variant supports embedded and remotely delivered plugins for keylogging, file manipulation and execution, storage enumeration, screen capture, and interactive keyboard and mouse control. It manually loads plugins, including remotely supplied components without writing them to disk, and stores configuration separately in the registry to complicate analysis. Other observed samples have been digitally signed. A Chinese-language graphical builder generates configurable 9002 binaries with primary and secondary command-and-control settings and proxy options.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The delivery document attached to the two spear-phishing attacks was an Excel document that exploits CVE-2012-0158, specifically exploiting a vulnerability in the MSComctlLib.TreeView ActiveX control. | The same digital certificate was used to sign a separate 9002 malware sample, which also shared the C2 domain ‘dns.mailpseonfz[.]com’ with a second 9002 sample.
The Internet Explorer (CVE-2013-1347) exploit code pulled down a “9002” RAT from another compromised site at hk[.]sz181[.]com. This payload had an MD5 of b0ef2ab86f160aa416184c09df8388fe and connected to a command and control server at dns[.]homesvr[.]tk.
The Internet Explorer (CVE-2013-1347) exploit code pulled down a “9002” RAT from another compromised site at hk[.]sz181[.]com. This payload had an MD5 of b0ef2ab86f160aa416184c09df8388fe and connected to a command and control server at dns[.]homesvr[.]tk.
The Internet Explorer (CVE-2013-1347) exploit code pulled down a “9002” RAT from another compromised site at hk[.]sz181[.]com. This payload had an MD5 of b0ef2ab86f160aa416184c09df8388fe and connected to a command and control server at dns[.]homesvr[.]tk.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The overlap between the HenBox and 9002 malware families involves three shared C2s between several samples...
The Internet Explorer (CVE-2013-1347) exploit code pulled down a “9002” RAT from another compromised site at hk[.]sz181[.]com. This payload had an MD5 of b0ef2ab86f160aa416184c09df8388fe and connected to a command and control server at dns[.]homesvr[.]tk.
Proofpoint recently observed a targeted email campaign attempting a spearphishing attack using a Game of Thrones lure... attempted to install a “9002” remote access Trojan (RAT) historically used by state-sponsored actors.
Tools: Sysupdate, China Chopper, OwaAuth, ZxShell, Gh0st RAT, PoisonIvy, Hunter, PlugX, Enfal, HttpBrowser, 9002, ASPXSpy, HyperBro
1 distinct technique documented for this family, organized by ATT&CK tactic.
38 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Trojan/backdoor family mentioned as part of the same overlapping infrastructure set tied to domains also used by Farseer-related activity.
Remote access trojan delivered via spearphishing (DOCX with embedded LNK/OLE packager) that executes PowerShell (modified Invoke-Shellcode) to download XOR/base64-obfuscated payloads, injects 9002 shellcode into a legitimate process (wabmig.exe), maintains persistence via Startup-folder LNK, and communicates with C2 over HTTP and a fake-SSL protocol while exfiltrating data.
The Trojan family underlying the 3102 variant used in the reported espionage attacks. Additional 9002 samples establish the infrastructure connection to Evilgrab: one shares the A'digm certificate with 3102, while another shares C2 infrastructure with both that 9002 sample and Evilgrab. The report treats these connections as evidence of likely common operators, not definitive attribution.
Trojan/backdoor malware family associated with Myanmar political-themed lures and infrastructure overlaps with HenBox, Poison Ivy, and the broader PKPLUG activity.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.