Loading malware…
EntryShell is a custom Windows backdoor associated with the China-linked espionage group Tropic Trooper, also tracked as Pirate Panda and KeyBoy. It has been observed as an in-memory payload delivered by Xiangoop loader variants through DLL side-loading, and it has also appeared alongside other Tropic Trooper tooling such as Cobalt Strike Beacon in staging infrastructure. Technical analysis has identified strong overlap between EntryShell and the older KeyBoy malware family, including matching embedded and encrypted strings tied to historical KeyBoy detections, leading to the assessment that EntryShell is an upgraded evolution of KeyBoy.
EntryShell is used in post-compromise operations to provide remote access and operator control on infected Windows systems. Its command structure and encrypted internal strings indicate backdoor functionality intended for hands-on intrusion activity. Reporting on Tropic Trooper campaigns places EntryShell within broader espionage operations involving deeper host investigation, remote control, and movement to additional endpoints or servers after initial access. The malware has been linked to campaigns targeting organizations and individuals in East Asia, including sectors such as government, healthcare, transportation, high technology, semiconductors, and rare-metal industries, with notable victim focus in Taiwan, Japan, South Korea, and China-related contexts.
Delivery of EntryShell has been observed indirectly through spearphishing-led intrusion chains and loader-based execution rather than as a standalone first-stage implant. In documented activity, Xiangoop loader families used email or SMS-based lures for initial compromise, then decrypted and deployed payloads such as EntryShell directly in memory. EntryShell’s design and deployment patterns are consistent with stealthy cyber-espionage tradecraft emphasizing staged execution, memory-resident payloading, and reuse of trusted or legitimate components for defense evasion.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
分析の結果、今回発見したマルウェアであるEntryShellが、過去に使われたマルウェアKeyBoyとの間に非常に多くの点で共通していることを確認しました。
6 distinct techniques documented for this family, organized by ATT&CK tactic.
攻撃者はこのYaraルールの存在を認知しており、セキュリティ製品による検知を回避するために、EntryShell内で使用しているYaraルールで検知されそうな特徴的な文字列を暗号化していると考えられます。
そうすると、文字列からバイナリデータへ変換したのち、AES ECBモードにて復号されていることがわかります。AESの鍵”afkngaikfaf”(実際にはpaddingが必要)は検体内の別の場所にハードコードされていました。
このマルウェアは初期感染を担い、ペイロードとしてCobalt Strike BeaconやEntryShellといったファイルレスマルウェアをメモリ上に展開します。
2nd Stageでは 遠隔操作によってその端末の情報をより深く調査したり、その端末から横移動をして別の端末やサーバを攻撃したりします。
TOSHIS loader downloads the PDF decoy from 58.247.193[.]100... TOSHIS loader then retrieves a second-stage shellcode from the same IP address...
2nd Stageでは 遠隔操作によってその端末の情報をより深く調査したり、その端末から横移動をして別の端末やサーバを攻撃したりします。
4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.