9002
9002 is a remote access Trojan (RAT) / backdoor family used in multiple China-linked espionage campaigns. Reporting ties it to the Sunshop ecosystem and to broader shared malware-development infrastructure that FireEye called the Sunshop Digital Quartermaster (SDQ). It has also been listed among tools used by BRONZE UNION / Emissary Panda / APT27. FireEye collected 70 Trojan.APT.9002 binaries across linked campaigns observed from July 2011 to September 2013, and identified a Chinese-language "9002 Builder" used to generate variants.
Observed delivery vectors include strategic web compromise and spearphishing. In the Sunshop Campaign, compromised websites redirected victims to exploits for CVE-2013-1347, CVE-2013-2423, and CVE-2013-1493, which dropped 9002 payloads. Documented samples include MD5 b0ef2ab86f160aa416184c09df8388fe connecting to dns[.]homesvr[.]tk, MD5 d99ed31af1e0ad6fb5bf0f116063e91f connecting to asp[.]homesvr[.]linkpc[.]net, and MD5 42bd5e7e8f74c15873ff0f4a9ce974cd connecting to ssl[.]homesvr[.]tk; these domains resolved to 58.64.205.53. Proofpoint also observed a targeted spearphishing campaign using a malicious DOCX ("game of thrones preview.docx") containing an embedded LNK that launched PowerShell, downloaded XOR/base64-obfuscated payloads, and installed a diskless 9002 RAT by injecting shellcode into wabmig.exe. Persistence was established via a Startup-folder LNK named UpdateCheck.lnk. Related 2014 activity used similar LNK downloaders and, in some cases, a Java payload named PhotoShow.jar to execute a diskless 9002 variant.
Capabilities directly described in the source material include remote access functionality, shellcode-based in-memory execution, process injection into legitimate Windows binaries, persistence via LNK files, HTTP communications, and a "fake SSL" protocol. The fake SSL traffic used hardcoded Client_Hello and Client_Key_Exchange packets and attempted to mimic traffic to login.live[.]com by placing that domain in the SNI field. HTTP POST data was encoded with a custom algorithm and then base64-encoded; the variant used hardcoded headers, a User-Agent of "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)", and URIs including /?FORM=Desktop&setmkt=en-us&setlang=en-us and /config/signin, with support for dynamically generated /%x.htm? URIs. Proofpoint described the encoding as an iteration of FireEye's previously analyzed 4-byte XOR 9002 variant, using a static 38-byte seed to generate a 256-byte XOR key combined with a dynamic 4-byte XOR key.
FireEye's analysis of the 9002 Builder indicates centralized tooling for creating variants. The builder title bar contained "[User_Server_Builder] update 2012-7-21" and supported configuration of primary and secondary C2, an ID (default "1"), an internet health-check domain (default update.microsoft.com), and proxy settings. The builder stored a server executable in PE resources under BIN, used a configuration block in the .data section with simple single-byte XOR encryption, and wrote configuration to HKCU\Software\Classes\sysinfo. FireEye also reported 24 9002 samples signed with a stolen or otherwise revoked/expired Mgame Corp certificate.
Known infrastructure and indicators mentioned in the content include C2 domains dns[.]homesvr[.]tk, asp[.]homesvr[.]linkpc[.]net, ssl[.]homesvr[.]tk, engage[.]intelfox[.]com, ru[.]pad62[.]com, tank[.]hja63[.]com, dtl[.]eatuo[.]com, dtl6[.]mooo[.]com, dtl[.]dnsd[.]me, and mx[.]i26[.]org; IP 27.255.83[.]3 with URLs http://27.255.83[.]3/x/ and http://27.255.83[.]3/y/; and import-table-linked infrastructure including ieee[.]boeing-job[.]com, lol[.]dns-lookup[.]us, twn[.]ftpmicrosoft[.]com, piping[.]no-ip[.]org, wv[.]downmicrisoft[.]com, mx[.]downmicrisoft[.]com, update1[.]mysq1[.]net, phpweb[.]zapto[.]org, and others. Reported targets across linked campaigns spanned 15 industries, including high-tech, financial services, telecommunications, federal government, and state/local government; BRONZE UNION reporting additionally cites government, technology, manufacturing, and NGO victims. Proofpoint assessed a possible connection between some 9002 activity and Deputy Dog / APT17, but stated it lacked definitive proof.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The Internet Explorer (CVE-2013-1347) exploit code pulled down a “9002” RAT from another compromised site at hk[.]sz181[.]com. This payload had an MD5 of b0ef2ab86f160aa416184c09df8388fe and connected to a command and control server at dns[.]homesvr[.]tk.
The Internet Explorer (CVE-2013-1347) exploit code pulled down a “9002” RAT from another compromised site at hk[.]sz181[.]com. This payload had an MD5 of b0ef2ab86f160aa416184c09df8388fe and connected to a command and control server at dns[.]homesvr[.]tk.
The Internet Explorer (CVE-2013-1347) exploit code pulled down a “9002” RAT from another compromised site at hk[.]sz181[.]com. This payload had an MD5 of b0ef2ab86f160aa416184c09df8388fe and connected to a command and control server at dns[.]homesvr[.]tk.
Groups observed using it
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The Internet Explorer (CVE-2013-1347) exploit code pulled down a “9002” RAT from another compromised site at hk[.]sz181[.]com. This payload had an MD5 of b0ef2ab86f160aa416184c09df8388fe and connected to a command and control server at dns[.]homesvr[.]tk.
Proofpoint recently observed a targeted email campaign attempting a spearphishing attack using a Game of Thrones lure... attempted to install a “9002” remote access Trojan (RAT) historically used by state-sponsored actors.
Proofpoint recently observed a targeted email campaign attempting a spearphishing attack using a Game of Thrones lure... attempted to install a “9002” remote access Trojan (RAT) historically used by state-sponsored actors.
Tools: Sysupdate, China Chopper, OwaAuth, ZxShell, Gh0st RAT, PoisonIvy, Hunter, PlugX, Enfal, HttpBrowser, 9002, ASPXSpy, HyperBro
IOCs tracked for this family
15 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Remote access trojan delivered via spearphishing (DOCX with embedded LNK/OLE packager) that executes PowerShell (modified Invoke-Shellcode) to download XOR/base64-obfuscated payloads, injects 9002 shellcode into a legitimate process (wabmig.exe), maintains persistence via Startup-folder LNK, and communicates with C2 over HTTP and a fake-SSL protocol while exfiltrating data.
9002 is a remote access trojan (RAT) used for persistent access and control of compromised systems, commonly deployed in targeted APT campaigns.
A named tool in BRONZE UNION’s toolkit; specific functionality is not described in the provided content.
Malware family heavily represented in the linked campaigns; associated with general-purpose launchers and a dedicated builder (“9002 Builder”) that configures primary/secondary C2, ID, internet health-check domain, and proxy settings. Configuration stored/encrypted (single-byte XOR) and written to HKCU\Software\Classes\sysinfo; later variants store config as a resource and can deliver different payloads (including Poison Ivy and 9002).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.