KeyBoy

KeyBoy is a form of malware, a harmful software designed to exploit and damage computer systems. It infects systems through various means such as suspicious downloads, emails, or websites. Once inside a system, it can steal personal information, disrupt operations, or hold data hostage for ransom. KeyBoy possesses a wide range of functionalities including screen grabbing, determining public or WAN IP addresses, gathering extended system information, launching interactive shells for communicating with the victim machine, download and upload functionality, and usage of custom SSL libraries for masquerading C2 traffic. The malware also achieves persistence through the WinLogon\Shell registry key, installed by the dropper’s execution of the Install export from the KeyBoy DLL. The malware has been associated with multiple groups, including TA413, Tropic Trooper (also known as Pirate Panda), Tick, Tonto Team, IceFog, and TA428. There have been observed historical correlations between TA413 and publicly reported Tropic Trooper activity, suggesting some degree of operational overlap. Tropic Trooper, which has been active since 2011, focuses its campaigns against Taiwanese, Philippine, and Hong Kong targets in government, healthcare, transportation, and high-tech industries. KeyBoy appears to be part of a development cycle that is updated only as necessary to evade antivirus detection and basic security controls. Multiple versions of KeyBoy reveal a development cycle focused on avoiding basic antivirus detection. The last observation of this malware was made in February, under the name PIRATE PANDA, also known as APT23 and Tropic Trooper. To aid further research, detailed analyses and indicators of compromise are provided for the KeyBoy samples analyzed.