Sainbox RAT Delivered Through Trojanized Software Installers

Summary

Sainbox RAT is a Gh0stRAT variant, also referred to as FatalRAT by third-party researchers, that has appeared in Proofpoint threat data over the years [6]. After a period of limited activity in email threat telemetry, the malware saw increased distribution starting in early 2023, with Proofpoint observing over 30 campaigns delivering Chinese-language malware — including Sainbox RAT, ValleyRAT, and Purple Fox — during that year [6] [5]. A separate campaign documented by Netskope Threat Labs uses fake software installers for WPS Office, Sogou, and DeepSeek to deliver Sainbox RAT alongside a modified version of the open-source Hidden rootkit [1]. The phishing pages and installers are written in Chinese, and the targeting focuses on Chinese-speaking users [1].

Netskope attributes the installer-based campaign to the China-based group Silver Fox with medium confidence, based on the TTPs involved: phishing websites mimicking Chinese software portals, use of Gh0stRAT variants, and the demographic targeting itself [1]. Silver Fox is also tracked as Void Arachne by other researchers [1].

Background on Sainbox RAT

Gh0stRAT has been in circulation since approximately 2008, according to public reporting. Its builder and source code are publicly available, which has produced numerous forked variants over the years [6]. Sainbox RAT is one such fork. Nearly all observed Sainbox campaigns prior to the installer-based activity used invoice-themed email lures spoofing Chinese office and invoicing companies [6]. Proofpoint assessed that the activity does not appear tied to a single operator. Rather, multiple distinct activity clusters are using the malware, differentiated by infrastructure, sender domains, content, targeting, and payload variety [6].

The 2023 email campaigns typically targeted Chinese-speaking users and organizations with operations in China, using emails written in Chinese around business themes like invoices, payments, and new products [6]. Alongside Sainbox, these campaigns also distributed Purple Fox (at least three campaigns) and a then-new malware family called ValleyRAT (at least six campaigns since March 2023) [5] [6].

Known Targeting

Ray Canzanese, director of Netskope's threat labs, stated that Silver Fox's typical modus operandi is to target Taiwanese organizations and individuals. He noted that the DeepSeek-themed campaign "has had some success but does not seem to be targeting any particular organization". Dark Reading characterized the activity as "a Chinese-language cyber-espionage campaign" targeting "systems of targeted Taiwanese citizens". Proofpoint's earlier reporting framed the broader Chinese-language malware campaigns as cybercrime rather than state-sponsored espionage [6]; the operational intent of the Silver Fox activity remains ambiguous.

The Proofpoint-tracked email campaigns from 2023 had a broader geographic scope, targeting organizations with operations in China [6]. On the email side, over 30 campaigns employing malware associated with Chinese cybercrime activity were detected in 2023 [5].

Initial Access: Phishing Websites and Fake Installers

The installer-based infection chain starts at a phishing website. These sites closely mimic legitimate software distribution pages. One documented example is the domain wpsice[.]com, which impersonated the official WPS Office website [1]. When a user clicks the download button on the fake page, the file is fetched from a URL different from the legitimate download source [1].

Netskope discovered fake installers for multiple software applications, including Sogou (a Chinese search engine), WPS Office (a productivity suite popular in China), and DeepSeek (an AI chatbot whose R1 large language model attracted significant attention) [1]. The phishing pages and the installer interfaces themselves are all in Chinese [1].

Most of the malicious installers are MSI files. The WPS Office variant was a PE executable rather than MSI [3]. In either case, the genuine software installs normally alongside the malware. The user sees a working application and has no immediate visual indicator of compromise [3].

Technical Detail: DLL Sideloading and Reflective Loading

Once executed, the MSI installer runs a legitimate binary named Shine.exe [1]. This binary sideloads a malicious DLL called libcef.dll, which is a counterfeit version of the Chromium Embedded Framework library [1]. The DLL's execution begins when Shine.exe calls the exported function cef_api_hash in the malicious DLL [3].

The DLL sets up persistence by adding itself to the Windows registry Run key under the name "Management" [3]. It then reads the contents of a dropped file named 1.txt into memory and redirects control flow to shellcode contained within that file [3].

The shellcode is based on the open-source sRDI (shellcode Reflective DLL Injection) tool. It performs reflective code loading, loading Install.dll into memory and calling its exported function Shellex to initiate the payload [1]. Reflective loading places the DLL into memory without using the standard Windows loader, which reduces artifacts visible to endpoint detection tools and avoids placing the final payload on disk as a standalone file.

Technical Detail: Sainbox RAT Capabilities

The DLL payload loaded via reflective injection is Sainbox RAT itself. It gives attackers full control of a compromised machine, including the ability to download and execute additional payloads and steal data [1] [2]. As a Gh0stRAT derivative, it follows the general capability pattern of that family: remote code execution, process enumeration, file system access, and the ability to use the host as a staging point for further operations.

Sainbox RAT contains an embedded PE binary in its .data section: a rootkit driver derived from the open-source Hidden project [3].

Technical Detail: Rootkit Component Analysis

The rootkit is installed as a Windows service named "Sainbox" via the NtLoadDriver function [1] [3]. Its primary function is concealment. It uses a mini-filter and kernel callbacks to hide processes, files, and registry keys and values associated with the malware [1] [4]. It can also protect itself and specific processes from being terminated by the user or by security tools [4]. The rootkit exposes a control interface via IOCTL calls that allows the operator to configure concealment and protection features [4].

The combination is straightforward: Sainbox RAT provides access and data theft capabilities, while the Hidden rootkit extends the attacker's dwell time by concealing malware artifacts from both the user and security products.

IOC Table

MITRE ATT&CK Mapping

Detection and Hunting

Endpoint Indicators

Look for the following on Windows endpoints:

• A Windows service named "Sainbox" created via NtLoadDriver. Query the service control manager or use sc query Sainbox across your fleet.
• A registry Run key entry named "Management" under HKCU\Software\Microsoft\Windows\CurrentVersion\Run or the HKLM equivalent.
• The file 1.txt dropped alongside a legitimate-looking executable. This file contains shellcode and should not exist in a normal software installation directory.
• Shine.exe loading libcef.dll from a non-standard path. Legitimate Chromium Embedded Framework deployments have a known directory structure; a standalone libcef.dll adjacent to an unrelated executable is anomalous.

DLL Sideloading Detection

Monitor for libcef.dll loaded by processes other than known Chromium-based applications. A Sigma rule for this pattern:

title: Suspicious libcef.dll Sideload by Non-Chromium Process
id: 3a7c8f12-b5e4-4d91-a023-9f1e6c7d8b45
status: experimental
author: RedSheepSec
date: 2025/07/15
description: Detects libcef.dll being loaded by a process not associated with Chromium-based applications, indicating potential DLL sideloading as seen in Sainbox RAT campaigns.
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\\libcef.dll'
    filter_chromium:
        Image|contains:
            - '\\chrome.exe'
            - '\\msedge.exe'
            - '\\brave.exe'
            - '\\opera.exe'
            - '\\cef'
    condition: selection and not filter_chromium
level: high
tags:
    - attack.defense_evasion
    - attack.t1574.002
falsepositives:
    - Legitimate applications embedding CEF that are not in the filter list

Network Indicators

Monitor DNS queries and outbound connections to the C2 domains listed in the IOC table (fakaka16[.]top, kakafa[.]top). Monitor for outbound TCP connections on non-standard ports, particularly 3366 and 3367.

Kernel Driver Loading

Monitor for NtLoadDriver calls that install unsigned or unfamiliar kernel drivers. Sysmon Event ID 6 (Driver Loaded) is the primary telemetry source. Flag any driver loaded as a service named "Sainbox."

Analysis

Sainbox RAT's return after a period of reduced activity, followed by sustained campaign activity from early 2023 onward, suggests the malware fills a specific operational niche. It provides commodity-grade remote access with low development overhead, since Gh0stRAT source code is freely available and Sainbox is a known fork [6]. The addition of the Hidden rootkit to the installer-based campaigns adds kernel-level concealment that commodity RATs typically lack on their own.

The shift from email-delivered compressed executables (the 2023 Proofpoint campaigns) to phishing websites distributing trojanized software installers (the Netskope-documented activity) represents a change in delivery method but not in fundamental approach. Both rely on Chinese-language lures and target Chinese-speaking users. The installer approach has the advantage of being more convincing: victims receive a working copy of the software they intended to install [3].

Netskope's medium-confidence attribution to Silver Fox rests on circumstantial alignment of TTPs rather than definitive technical linkage [1]. Proofpoint's earlier reporting did not attribute the 2023 email campaigns to a specific group, instead noting that multiple activity clusters appeared to be involved [6]. Whether the installer-based Sainbox campaigns and the email-based campaigns share operators remains unconfirmed.

References

[1] https://www.netskope.com/blog/deepseek-deception-sainbox-rat-hidden-rootkit-delivery

[2] https://thehackernews.com/2025/06/chinese-group-silver-fox-uses-fake.html

[3] https://gbhackers.com/threat-actors-impersonate-wps-office-and-deepseek/

[4] https://www.securityweek.com/chinese-hackers-target-chinese-users-with-rat-rootkit/

[5] https://thehackernews.com/2023/09/sophisticated-phishing-campaign_20.html

[6] https://www.proofpoint.com/us/blog/threat-insight/chinese-malware-appears-earnest-across-cybercrime-threat-landscape

[7] https://attack.mitre.org/techniques/T1014/

[8] https://github.com/netskopeoss/NetskopeThreatLabsIOCs/tree/main/Malware/Sainbox/IOCs

Entity Relationships

Diamond Model

Hunt Guide: Sainbox RAT Delivered Through Trojanized Software Installers (Silver Fox / Void Arachne)

Attribution: Rules adapted, ported, or quoted from a public source retain that source's author (e.g. SigmaHQ / Florian Roth, Elastic, Emerging Threats, Abuse.ch, or the cited vendor/researcher) and carry an attribution credit. Rules without a credit were authored in-house by RedSheepSec. If you reuse a rule, preserve its stated attribution.

Hypothesis: If Sainbox RAT or its associated Hidden rootkit has been delivered to endpoints in our environment via trojanized software installers or phishing campaigns, we expect to observe DLL sideloading of libcef.dll by non-Chromium processes, a Windows service named 'Sainbox', a registry Run key entry named 'Management', DNS queries to known C2 domains (fakaka16.top, kakafa.top, wpsice.com), and outbound connections to associated IPs on non-standard ports (3366, 3367) in Sysmon, DNS, EDR, and network telemetry.

Intelligence Summary: Sainbox RAT, a Gh0stRAT variant also referred to as FatalRAT, is being distributed through trojanized software installers for WPS Office, Sogou, and DeepSeek that mimic legitimate Chinese software portals. The campaign, attributed with medium confidence to the China-based group Silver Fox (also tracked as Void Arachne), deploys Sainbox RAT alongside a modified open-source Hidden rootkit that conceals malware artifacts at the kernel level. The infection chain uses DLL sideloading via Shine.exe loading a malicious libcef.dll, followed by reflective DLL injection of the RAT payload, with the rootkit installed as a Windows service named 'Sainbox' to extend attacker dwell time.

Confidence: Moderate | Priority: High

Scope

• Networks: All Windows endpoints, with emphasis on workstations where users may download software installers. Include systems with Chinese-language locale settings or systems used by Chinese-speaking personnel.
• Timeframe: 90 days retrospective from current date, covering the period from April 2025 through July 2025 to capture any recent installer-based campaign activity. Extend to January 2023 for email-based campaign IOC sweeps.
• Priority Systems: User workstations, particularly those belonging to personnel with operations or business relationships in China or Taiwan. Systems where WPS Office, Sogou, or DeepSeek may have been downloaded. Systems with recent unsigned driver load events.

MITRE ATT&CK Techniques

T1204.002: User Execution: Malicious File (Execution) [P2]

Victims download and execute fake MSI or PE installers from phishing websites mimicking WPS Office, Sogou, or DeepSeek. The installers deliver working software alongside malware, providing no immediate visual indicator of compromise.

Splunk SPL:

index=sysmon EventCode=1 (OriginalFileName="*.msi" OR OriginalFileName="Shine.exe" OR ParentImage="*\\msiexec.exe") (Image="*\\Shine.exe" OR CommandLine="*Shine*")
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image ParentImage CommandLine User
| sort - count

Elastic KQL:

event.code:"1" AND (process.name:"Shine.exe" OR (process.parent.name:"msiexec.exe" AND process.name:"Shine.exe"))

Sigma Rule:

title: Execution of Shine.exe Sideloading Binary from Sainbox RAT Campaign
id: a1b2c3d4-e5f6-7890-abcd-ef1234567890
status: experimental
author: RedSheepSec
date: 2025/07/15
description: Detects execution of Shine.exe, a legitimate binary abused in Sainbox RAT campaigns for DLL sideloading.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\\Shine.exe'
    filter_legitimate:
        Image|contains:
            - '\\Program Files\\'
            - '\\Program Files (x86)\\'
    condition: selection and not filter_legitimate
level: high
tags:
    - attack.execution
    - attack.t1204.002
falsepositives:
    - Legitimate software named Shine.exe in non-standard paths

Tune by whitelisting known legitimate Shine.exe binaries in your environment. Focus on instances where Shine.exe appears in temp directories, user Downloads, or AppData paths.

T1574.002: Hijack Execution Flow: DLL Side-Loading (Defense Evasion) [P1]

Shine.exe sideloads a malicious DLL named libcef.dll, a counterfeit Chromium Embedded Framework library. The DLL exports the function cef_api_hash, which is called by Shine.exe to initiate the malicious execution chain.

Splunk SPL:

index=sysmon EventCode=7 ImageLoaded="*\\libcef.dll"
| eval is_chromium=if(match(Image, "(?i)(chrome|msedge|brave|opera|cef)"), 1, 0)
| where is_chromium=0
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image ImageLoaded Signed SignatureStatus Hashes
| sort - count

Elastic KQL:

event.code:"7" AND file.name:"libcef.dll" AND NOT process.name:("chrome.exe" OR "msedge.exe" OR "brave.exe" OR "opera.exe")

Sigma Rule:

title: Suspicious libcef.dll Sideload by Non-Chromium Process
id: 3a7c8f12-b5e4-4d91-a023-9f1e6c7d8b45
status: experimental
author: RedSheepSec
date: 2025/07/15
description: Detects libcef.dll being loaded by a process not associated with Chromium-based applications, indicating potential DLL sideloading as seen in Sainbox RAT campaigns.
logsource:
    category: image_load
    product: windows
detection:
    selection:
        ImageLoaded|endswith: '\\libcef.dll'
    filter_chromium:
        Image|contains:
            - '\\chrome.exe'
            - '\\msedge.exe'
            - '\\brave.exe'
            - '\\opera.exe'
            - '\\cef'
    condition: selection and not filter_chromium
level: high
tags:
    - attack.defense_evasion
    - attack.t1574.002
falsepositives:
    - Legitimate applications embedding CEF that are not in the filter list

Expect false positives from applications that embed CEF such as Spotify, Discord, Slack, and others. Build a whitelist of known CEF consumers in your environment. The key differentiator is Shine.exe loading libcef.dll; this specific pair is highly suspicious.

T1620: Reflective Code Loading (Defense Evasion) [P2]

The malicious libcef.dll reads shellcode from a dropped file named 1.txt. The shellcode uses the open-source sRDI (shellcode Reflective DLL Injection) tool to reflectively load Install.dll into memory and call its exported function Shellex, avoiding placement of the final payload on disk as a standalone file.

Splunk SPL:

index=sysmon (EventCode=11 TargetFilename="*\\1.txt") OR (EventCode=7 ImageLoaded="*\\Install.dll" Signed="false")
| stats count min(_time) as first_seen max(_time) as last_seen values(EventCode) as event_codes by Computer Image TargetFilename ImageLoaded
| sort - count

Elastic KQL:

(event.code:"11" AND file.name:"1.txt") OR (event.code:"7" AND file.name:"Install.dll" AND dll.code_signature.exists:false)

Sigma Rule:

title: Suspicious 1.txt File Creation Indicative of Sainbox RAT Shellcode Drop
id: d4e5f6a7-b8c9-0123-4567-890abcdef012
status: experimental
author: RedSheepSec
date: 2025/07/15
description: Detects creation of a file named 1.txt in unexpected locations, which in Sainbox RAT campaigns contains shellcode used for reflective DLL injection.
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: '\\1.txt'
    filter_temp:
        TargetFilename|contains:
            - '\\Temp\\'
            - '\\AppData\\'
            - '\\ProgramData\\'
    condition: selection and filter_temp
level: medium
tags:
    - attack.defense_evasion
    - attack.t1620
falsepositives:
    - Legitimate applications writing files named 1.txt to temp directories

This rule has a higher false positive rate due to the generic filename. Correlate with the presence of Shine.exe and libcef.dll in the same directory to increase fidelity. The file 1.txt should not exist alongside a legitimate software installer.

T1014: Rootkit (Defense Evasion) [P1]

The Hidden rootkit, modified from the open-source Hidden project, is installed as a Windows service named 'Sainbox' via the NtLoadDriver function. It uses a mini-filter and kernel callbacks to hide processes, files, and registry keys associated with the malware and can protect itself from termination by users or security tools.

Splunk SPL:

index=sysmon EventCode=6
| eval is_signed=if(Signed="true", 1, 0)
| where is_signed=0 OR match(ImageLoaded, "(?i)sainbox")
| stats count min(_time) as first_seen max(_time) as last_seen by Computer ImageLoaded Hashes Signed SignatureStatus
| sort - count

Elastic KQL:

event.code:"6" AND (dll.code_signature.exists:false OR file.name:*sainbox*)

Sigma Rule:

title: Sainbox Rootkit Service Installation via Driver Load
id: e5f6a7b8-c9d0-1234-5678-90abcdef0123
status: experimental
author: RedSheepSec
date: 2025/07/15
description: Detects loading of an unsigned kernel driver or a driver associated with the Sainbox service name, indicating potential Hidden rootkit installation.
logsource:
    category: driver_load
    product: windows
detection:
    selection_unsigned:
        Signed: 'false'
    selection_sainbox:
        ImageLoaded|contains: 'sainbox'
    condition: selection_unsigned or selection_sainbox
level: critical
tags:
    - attack.defense_evasion
    - attack.t1014
falsepositives:
    - Unsigned drivers from legitimate but poorly signed software vendors

Unsigned driver loads in modern Windows environments should be rare and always investigated. Correlate with Windows System Event 7045 for service creation. The service name 'Sainbox' is a direct indicator of the Hidden rootkit variant used in these campaigns.

T1547.001: Boot or Logon Autostart Execution: Registry Run Keys (Persistence) [P1]

The malicious libcef.dll establishes persistence by adding itself to the Windows registry Run key under the name 'Management', ensuring the sideloading chain executes on each user logon.

Splunk SPL:

index=sysmon EventCode=13 TargetObject="*\\CurrentVersion\\Run*" Details="*Management*"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image TargetObject Details
| sort - count

Elastic KQL:

event.code:"13" AND registry.path:*CurrentVersion\\Run* AND registry.value:"Management"

Sigma Rule:

title: Sainbox RAT Persistence via Management Registry Run Key
id: f6a7b8c9-d0e1-2345-6789-0abcdef01234
status: experimental
author: RedSheepSec
date: 2025/07/15
description: Detects creation of a registry Run key entry named Management, used by Sainbox RAT for persistence.
logsource:
    category: registry_set
    product: windows
detection:
    selection:
        TargetObject|contains: '\\CurrentVersion\\Run'
        Details|contains: 'Management'
    condition: selection
level: high
tags:
    - attack.persistence
    - attack.t1547.001
falsepositives:
    - Legitimate software using a Run key named Management

The registry value name 'Management' is fairly generic. Correlate with the file path in the Details field; if it points to libcef.dll or Shine.exe in a non-standard location, the finding is high confidence. Also look for the co-occurrence of the 'Sainbox' service.

T1036: Masquerading (Defense Evasion) [P1]

Fake installers impersonate legitimate software (WPS Office, Sogou, DeepSeek) via phishing websites that closely mimic official software distribution pages. The installers install genuine software alongside the malware, providing no visual indicator of compromise.

Splunk SPL:

index=corelight sourcetype=corelight_dns query IN ("wpsice.com", "*.wpsice.com", "app-zoom.com", "signal-signal.com", "www-surfshark.com", "trezor-trezor.com")
| stats count min(_time) as first_seen max(_time) as last_seen by id.orig_h query answers
| sort - count

Elastic KQL:

dns.question.name:("wpsice.com" OR "app-zoom.com" OR "signal-signal.com" OR "www-surfshark.com" OR "trezor-trezor.com")

Monitor for DNS queries to typosquatted domains that impersonate popular software. The phishing pages are in Chinese but may still appear in environments with Chinese-speaking personnel or if users search for Chinese software.

Indicators of Compromise

IOC Sweep Queries (Splunk):

index=corelight sourcetype=corelight_dns query="wpsice.com" OR query="*.wpsice.com"
| stats count min(_time) as first_seen max(_time) as last_seen by id.orig_h query answers
| sort - count

index=corelight sourcetype=corelight_dns query="fakaka16.top" OR query="*.fakaka16.top"
| stats count min(_time) as first_seen max(_time) as last_seen by id.orig_h query answers
| append [search index=corelight sourcetype=corelight_conn id.resp_p=3366 | stats count min(_time) as first_seen max(_time) as last_seen by id.orig_h id.resp_h id.resp_p]
| sort - count

index=corelight sourcetype=corelight_dns query="kakafa.top" OR query="*.kakafa.top"
| stats count min(_time) as first_seen max(_time) as last_seen by id.orig_h query answers
| append [search index=corelight sourcetype=corelight_conn id.resp_p=3367 | stats count min(_time) as first_seen max(_time) as last_seen by id.orig_h id.resp_h id.resp_p]
| sort - count

index=corelight sourcetype=corelight_dns query="bifa668.com" OR query="*.bifa668.com"
| stats count min(_time) as first_seen max(_time) as last_seen by id.orig_h query answers
| sort - count

index=corelight sourcetype=corelight_dns query="app-zoom.com" OR query="*.app-zoom.com"
| stats count min(_time) as first_seen max(_time) as last_seen by id.orig_h query answers
| sort - count

index=corelight sourcetype=corelight_dns query="signal-signal.com" OR query="*.signal-signal.com"
| stats count min(_time) as first_seen max(_time) as last_seen by id.orig_h query answers
| sort - count

index=corelight sourcetype=corelight_dns query="www-surfshark.com" OR query="*.www-surfshark.com"
| stats count min(_time) as first_seen max(_time) as last_seen by id.orig_h query answers
| sort - count

index=corelight sourcetype=corelight_dns query="trezor-trezor.com" OR query="*.trezor-trezor.com"
| stats count min(_time) as first_seen max(_time) as last_seen by id.orig_h query answers
| sort - count

index=corelight sourcetype=corelight_conn (id.orig_h="45.207.12.71" OR id.resp_h="45.207.12.71")
| stats count min(_time) as first_seen max(_time) as last_seen by id.orig_h id.resp_h id.resp_p proto
| append [search index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="45.207.12.71" OR dest_ip="45.207.12.71") | stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip dest_port]
| sort - count

index=corelight sourcetype=corelight_conn (id.orig_h="154.23.221.136" OR id.resp_h="154.23.221.136")
| stats count min(_time) as first_seen max(_time) as last_seen by id.orig_h id.resp_h id.resp_p proto
| append [search index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="154.23.221.136" OR dest_ip="154.23.221.136") | stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip dest_port]
| sort - count

index=corelight sourcetype=corelight_conn (id.orig_h="206.119.124.126" OR id.resp_h="206.119.124.126")
| stats count min(_time) as first_seen max(_time) as last_seen by id.orig_h id.resp_h id.resp_p proto
| append [search index=firewall-pan sourcetype="pan:traffic:aggregated" (src_ip="206.119.124.126" OR dest_ip="206.119.124.126") | stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_ip dest_port]
| sort - count

index=sysmon (EventCode=1 OR EventCode=6 OR EventCode=7) Hashes="*7f32ca98ce66a057ae226ec78638db95feebc59295d3afffdbf407df12b5bc79*"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image Hashes
| sort - count

index=sysmon (EventCode=1 OR EventCode=6 OR EventCode=7) Hashes="*ec89ec41f0e0a7e60fa3f6267d0197c7fa8568e11a2c564f6d59855ddd9e1d64*"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image Hashes
| sort - count

index=sysmon (EventCode=1 OR EventCode=6 OR EventCode=7) Hashes="*ab41cac917bd44f0cbe192dac9539321*"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image Hashes
| sort - count

index=sysmon (EventCode=1 OR EventCode=6 OR EventCode=7) Hashes="*f0893bba522061e58299c295f5838dfc*"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image Hashes
| sort - count

index=sysmon (EventCode=1 OR EventCode=6 OR EventCode=7) Hashes="*ba6a4699f59e557537bcb6463b4ba75b*"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image Hashes
| sort - count

index=sysmon (EventCode=1 OR EventCode=6 OR EventCode=7) Hashes="*bb43584e3308237bd97fb2cd483898a0*"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image Hashes
| sort - count

index=sysmon (EventCode=1 OR EventCode=6 OR EventCode=7) Hashes="*8c6df59659d4407fa4a07cc094f46dd5*"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image Hashes
| sort - count

index=sysmon (EventCode=1 OR EventCode=6 OR EventCode=7) Hashes="*6442971b32bad1f3b30306b60544faea*"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image Hashes
| sort - count

index=sysmon (EventCode=1 OR EventCode=6 OR EventCode=7) Hashes="*0056d6f321a87caf26ee800933ba4bcf*"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image Hashes
| sort - count

index=sysmon (EventCode=1 OR EventCode=6 OR EventCode=7) Hashes="*78f0f18cddf3d9ff82d001a2b5eaa429*"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image Hashes
| sort - count

index=sysmon (EventCode=1 OR EventCode=6 OR EventCode=7) Hashes="*c4582684928195f0ee6d2411bdf5dfad*"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image Hashes
| sort - count

index=sysmon (EventCode=1 OR EventCode=6 OR EventCode=7) Hashes="*fe56bca80c57480cd68c43c192fca295*"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image Hashes
| sort - count

index=sysmon (EventCode=1 OR EventCode=6 OR EventCode=7) Hashes="*c08b995f8a76f1059ba188dc862c98a2*"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image Hashes
| sort - count

index=sysmon (EventCode=1 OR EventCode=6 OR EventCode=7) Hashes="*1b1ebdb45ed02695370227e7c897910e*"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image Hashes
| sort - count

index=sysmon (EventCode=1 OR EventCode=6 OR EventCode=7) Hashes="*966310f10069f8443fe4d8adf4a7bd80*"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image Hashes
| sort - count

index=sysmon (EventCode=1 OR EventCode=6 OR EventCode=7) Hashes="*487fb061ed51046206e69b9c8f41e935*"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image Hashes
| sort - count

index=sysmon (EventCode=1 OR EventCode=6 OR EventCode=7) Hashes="*e59062d8ab72d71a9b9ba8b4152e730d*"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image Hashes
| sort - count

index=sysmon (EventCode=1 OR EventCode=6 OR EventCode=7) Hashes="*ab9ab337c4f4284b1176fa65817df5fe*"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image Hashes
| sort - count

index=sysmon (EventCode=1 OR EventCode=6 OR EventCode=7) Hashes="*a04c9630adf4eadf3ac896bff8d9ead8*"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image Hashes
| sort - count

index=sysmon (EventCode=1 OR EventCode=6 OR EventCode=7) Hashes="*c12f28d8a2e5726c8125c5738d97d478*"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image Hashes
| sort - count

index=sysmon (EventCode=1 OR EventCode=6 OR EventCode=7) Hashes="*af83e150039051d930ae3eec0dc8081b02719beb*"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image Hashes
| sort - count

index=sysmon EventCode=1 Image="*\\Shine.exe"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image ParentImage CommandLine User Hashes
| sort - count

index=sysmon EventCode=7 ImageLoaded="*\\libcef.dll" NOT Image IN ("*\\chrome.exe", "*\\msedge.exe", "*\\brave.exe", "*\\opera.exe")
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image ImageLoaded Hashes
| sort - count

index=sysmon EventCode=11 TargetFilename="*\\1.txt" (TargetFilename="*\\Temp\\*" OR TargetFilename="*\\AppData\\*" OR TargetFilename="*\\ProgramData\\*")
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image TargetFilename
| sort - count

index=sysmon EventCode=7 ImageLoaded="*\\Install.dll"
| stats count min(_time) as first_seen max(_time) as last_seen by Computer Image ImageLoaded Hashes Signed
| sort - count

YARA Rules

Sainbox_RAT_Artifacts: Detects Sainbox RAT installer artifacts including the sideloading binary, malicious DLL, and rootkit service name

rule Sainbox_RAT_Artifacts {
    meta:
        author = "RedSheepSec"
        description = "Detects Sainbox RAT installer artifacts and rootkit indicators"
        date = "2025-07-15"
        reference = "https://www.netskope.com/blog/deepseek-deception-sainbox-rat-hidden-rootkit-delivery"
        threat = "Sainbox RAT / FatalRAT / Gh0stRAT variant"
    strings:
        $sideload_dll = "libcef.dll" ascii wide
        $export_func = "cef_api_hash" ascii
        $shellcode_file = "1.txt" ascii wide
        $inject_dll = "Install.dll" ascii wide
        $export_shellex = "Shellex" ascii
        $service_name = "Sainbox" ascii wide
        $sideload_exe = "Shine.exe" ascii wide
        $srdi_marker = "sRDI" ascii
        $management_key = "Management" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        (3 of them)
}

Sainbox_RAT_Hashes: Detects known Sainbox RAT samples by SHA256 hash patterns from Proofpoint and Netskope IOC lists

rule Sainbox_RAT_Known_Hash {
    meta:
        author = "RedSheepSec"
        description = "Detects known Sainbox RAT sample by SHA256 hash"
        date = "2025-07-15"
        reference = "https://github.com/netskopeoss/NetskopeThreatLabsIOCs/tree/main/Malware/Sainbox/IOCs"
    strings:
        $s1 = "Sainbox" ascii wide nocase
        $s2 = "cef_api_hash" ascii
        $s3 = "NtLoadDriver" ascii
        $s4 = "Shellex" ascii
        $gh0st1 = { 47 68 30 73 74 } // "Gh0st"
        $gh0st2 = "Gh0stRAT" ascii wide nocase
    condition:
        uint16(0) == 0x5A4D and
        (2 of ($s*) or any of ($gh0st*))
}

Suricata Rules

SID 2025071501: Detects DNS query to Sainbox RAT C2 domain fakaka16.top

alert dns $HOME_NET any -> any any (msg:"HUNT - Sainbox RAT C2 DNS Query - fakaka16.top"; dns.query; content:"fakaka16.top"; nocase; classtype:trojan-activity; sid:2025071501; rev:1; metadata:created_at 2025_07_15, updated_at 2025_07_15;)

SID 2025071502: Detects DNS query to Sainbox RAT C2 domain kakafa.top

alert dns $HOME_NET any -> any any (msg:"HUNT - Sainbox RAT C2 DNS Query - kakafa.top"; dns.query; content:"kakafa.top"; nocase; classtype:trojan-activity; sid:2025071502; rev:1; metadata:created_at 2025_07_15, updated_at 2025_07_15;)

SID 2025071503: Detects DNS query to Sainbox RAT phishing domain wpsice.com

alert dns $HOME_NET any -> any any (msg:"HUNT - Sainbox RAT Phishing Domain DNS Query - wpsice.com"; dns.query; content:"wpsice.com"; nocase; classtype:trojan-activity; sid:2025071503; rev:1; metadata:created_at 2025_07_15, updated_at 2025_07_15;)

SID 2025071504: Detects outbound TCP connections to Sainbox RAT C2 on port 3366

alert tcp $HOME_NET any -> $EXTERNAL_NET 3366 (msg:"HUNT - Potential Sainbox RAT C2 Communication on Port 3366"; flow:to_server,established; classtype:trojan-activity; sid:2025071504; rev:1; metadata:created_at 2025_07_15, updated_at 2025_07_15;)

SID 2025071505: Detects outbound TCP connections to Sainbox RAT C2 on port 3367

alert tcp $HOME_NET any -> $EXTERNAL_NET 3367 (msg:"HUNT - Potential Sainbox RAT C2 Communication on Port 3367"; flow:to_server,established; classtype:trojan-activity; sid:2025071505; rev:1; metadata:created_at 2025_07_15, updated_at 2025_07_15;)

SID 2025071506: Detects outbound TCP to Sainbox RAT indicator IP 45.207.12.71

alert ip $HOME_NET any -> 45.207.12.71 any (msg:"HUNT - Sainbox RAT Indicator IP 45.207.12.71"; classtype:trojan-activity; sid:2025071506; rev:1; metadata:created_at 2025_07_15, updated_at 2025_07_15;)

SID 2025071507: Detects outbound TCP to Sainbox RAT indicator IP 154.23.221.136

alert ip $HOME_NET any -> 154.23.221.136 any (msg:"HUNT - Sainbox RAT Indicator IP 154.23.221.136"; classtype:trojan-activity; sid:2025071507; rev:1; metadata:created_at 2025_07_15, updated_at 2025_07_15;)

SID 2025071508: Detects outbound TCP to Sainbox RAT indicator IP 206.119.124.126

alert ip $HOME_NET any -> 206.119.124.126 any (msg:"HUNT - Sainbox RAT Indicator IP 206.119.124.126"; classtype:trojan-activity; sid:2025071508; rev:1; metadata:created_at 2025_07_15, updated_at 2025_07_15;)

SID 2025071509: Detects DNS query to Silver Fox typosquatted domain bifa668.com

alert dns $HOME_NET any -> any any (msg:"HUNT - Silver Fox C2 Domain DNS Query - bifa668.com"; dns.query; content:"bifa668.com"; nocase; classtype:trojan-activity; sid:2025071509; rev:1; metadata:created_at 2025_07_15, updated_at 2025_07_15;)

Data Source Requirements

Recommendations

• Deploy all Sigma rules from this report to Splunk and Elastic detection pipelines, prioritizing the libcef.dll sideloading rule (P1) and the Sainbox rootkit driver load rule (P1).
• Deploy all Suricata rules to network IDS/IPS sensors to detect DNS queries to Sainbox RAT C2 domains and outbound connections on ports 3366, 3367, and 9899.
• Block the following domains at DNS and proxy layers: wpsice.com, fakaka16.top, kakafa.top, bifa668.com, app-zoom.com, signal-signal.com, www-surfshark.com, trezor-trezor.com.
• Block the following IPs at the network perimeter after verifying against the Netskope GitHub IOC repository: 45.207.12.71, 154.23.221.136, 206.119.124.126.
• Conduct a fleet-wide sweep for the Windows service named 'Sainbox' using CrowdStrike RTR or equivalent EDR capability. Any match is a confirmed indicator of the Hidden rootkit.
• Audit all Windows endpoints for registry Run key entries named 'Management' under HKCU and HKLM CurrentVersion Run paths. Cross-reference the target binary path against known-good software inventories.
• Ensure Sysmon EventID 6 (Driver Loaded) and EventID 7 (Image Loaded) are enabled across the fleet with hash logging. These are critical for detecting the rootkit and sideloading components of this threat.
• Brief personnel with operations or business relationships in China and Taiwan on the specific social engineering technique: trojanized installers for WPS Office, Sogou, and DeepSeek that appear fully functional while silently deploying malware.
• Restrict software installation sources via application control or group policy to prevent users from downloading installers from unvetted websites.

Sources

• Netskope Threat Labs - DeepSeek Deception: Sainbox RAT Hidden Rootkit Delivery
• The Hacker News - Chinese Group Silver Fox Uses Fake Software Installers
• GBHackers - Threat Actors Impersonate WPS Office and DeepSeek
• SecurityWeek - Chinese Hackers Target Chinese Users with RAT Rootkit
• The Hacker News - Sophisticated Phishing Campaign (September 2023)
• Proofpoint - Chinese Malware Appears in Earnest Across Cybercrime Threat Landscape
• MITRE ATT&CK - T1014 Rootkit
• Netskope ThreatLabs IOCs - Sainbox Malware IOC Repository